TYPO3 up to 4.1.13/4.2.12/4.3.3/4.4.0 Backend sql injection

Summaryinfo

A vulnerability labeled as critical has been found in TYPO3 up to 4.1.13/4.2.12/4.3.3/4.4.0. Affected by this vulnerability is an unknown functionality of the component Backend. Executing a manipulation can lead to sql injection. This vulnerability is handled as CVE-2010-3662. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in TYPO3 up to 4.1.13/4.2.12/4.3.3/4.4.0 (Content Management System). It has been declared as critical. This vulnerability affects an unknown part of the component Backend. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.

The weakness was released 11/04/2019 (Website). The advisory is available at typo3.org. This vulnerability was named CVE-2010-3662 since 09/28/2010. The attack can be initiated remotely. A single authentication is necessary for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

Upgrading to version 4.1.14, 4.2.13, 4.3.4 or 4.4.1 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-144830, VDB-144829, VDB-144828 and VDB-144827. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• TYPO3

Version

• 4.0
• 4.1
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.1.11
• 4.1.12
• 4.1.13
• 4.2
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.3
• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.4.0

License

• open-source

Website

• Product: https://typo3.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion