GitHub Advisoryadvisory · Packagist

GHSA-wq4r-8342-jmc9 SQL injection in vhs (aka VHS: Fluid ViewHelpers)

CRITICAL Published 2021-03-29 Modified 2021-03-23 Official page ↗

Aliases: CVE-2021-28381
Ecosystem: Packagist
Packages: fluidtypo3/vhs
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C
Weaknesses: CWE-89
Reviewed: 2021-03-23

Affected packages

• Packagist fluidtypo3/vhs: < 5.1.1 → fixed in 5.1.1

Description

The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.

Related

Alias · CVE (1)

CVE-2021-28381 The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper. vulnerability

Weakness · CWE (1)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References