GitHub Advisoryadvisory · Packagist

GHSA-5v5h-4w2g-gxxc SQL Injection in t3/dce

HIGH Published 2021-06-08 Modified 2021-05-03 Official page ↗
Aliases
CVE-2021-31777
Ecosystem
Packagist
Packages
t3/dce
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-89
Reviewed
2021-05-03

Affected packages

• Packagist t3/dce: >= 2.2.0, < 2.6.2 → fixed in 2.6.2

Description

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.

Related

Alias · CVE (1)

  • CVE-2021-31777 The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References