GHSA-947m-vgqc-x6v4Medium

Typo3 Backend History Module Vulnerable to SQL Injection

Published
May 17, 2022
Last Modified
January 12, 2024

🔗 CVE IDs covered (1)

CVE-2012-6144 →

📋 Description

SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.

🎯 Affected products3

  • composer/typo3/cms:>= 4.5.0, <= 4.5.20
  • composer/typo3/cms:>= 4.6.0, <= 4.6.13
  • composer/typo3/cms:>= 4.7.0, <= 4.7.5

🔗 References (5)