GitHub Advisoryadvisory · Packagist

GHSA-m64j-j252-jxmr TYPO3 SQL injection vulnerability in the Extbase Framework

HIGH Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-1842
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-89
Reviewed
2023-08-29

Affected packages

• Packagist typo3/cms-core: >= 4.5.0, < 4.5.24 → fixed in 4.5.24 • Packagist typo3/cms-core: >= 4.6.0, < 4.6.17 → fixed in 4.6.17 • Packagist typo3/cms-core: >= 4.7.0, < 4.7.9 → fixed in 4.7.9 • Packagist typo3/cms-core: >= 6.0.0, < 6.0.3 → fixed in 6.0.3

Description

SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."

Related

Alias · CVE (1)

  • CVE-2013-1842 SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References