PT-2021-19500 · Unknown · Dce Extension

Published 2021-04-28 · Updated 2021-08-27 · CVE-2021-31777

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions dce extension versions 2.2.0 through 2.6.x before 2.6.2 dce extension versions 2.7.x before 2.7.1

Description The issue allows SQL Injection via a backend user account. This can be exploited to inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

Recommendations For dce extension versions 2.2.0 through 2.6.x before 2.6.2, update to version 2.6.2 or later. For dce extension versions 2.7.x before 2.7.1, update to version 2.7.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-31777

GHSA-5V5H-4W2G-GXXC

Affected Products

Dce Extension

References · 12

• 🔥 http://packetstormsecurity.com/files/162429/TYPO3-6.2.1-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-31777 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5v5h-4w2g-gxxc · Vendor Advisory
• https://typo3.org/security/advisory/typo3-ext-sa-2021-005 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-31777 · Security Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31777 · Note
• https://excellium-services.com/cert-xlm-advisory · Note
• https://packagist.org/packages/t3/dce · Note
• https://bitbucket.org/ArminVieweg/dce/commits/998a2392f69f2153797c5ace6e8914ca309e70c7 · Note
• https://t.me/cvenotify/13982 · Telegram Post
• https://t.me/cvenotify/14265 · Telegram Post
• https://t.me/cvenotify/13837 · Telegram Post