GitHub Advisoryadvisory · Packagist

GHSA-xgc2-q928-27wv TYPO3 Sensitive Information Disclosure via escapeStrForLike method

MEDIUM Published 2022-05-17 Modified 2024-02-07 Official page ↗
Aliases
CVE-2010-5104
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-02-07

Affected packages

• Packagist typo3/cms-core: >= 4.2.0, < 4.2.16 → fixed in 4.2.16 • Packagist typo3/cms-core: >= 4.3.0, < 4.3.9 → fixed in 4.3.9 • Packagist typo3/cms-core: >= 4.4.0, < 4.4.5 → fixed in 4.4.5

Description

The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.

Related

Alias · CVE (1)

  • CVE-2010-5104 The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References