SQL Injection Affecting typo3/cms package, versions >=10.0.0, <10.2.1>=9.0.0, <9.5.12>=8.0.0, <8.7.30


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.09% (39th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-TYPO3CMS-538226
  • published18 Dec 2019
  • disclosed17 Dec 2019
  • creditDhiraj Shrikant Data

Introduced: 17 Dec 2019

CVE-2019-19850  (opens in a new tab)
CWE-89  (opens in a new tab)

How to fix?

Upgrade typo3/cms to version 10.2.1, 9.5.12, 8.7.30 or higher.

Overview

typo3/cms is a free open source Content Management Framework.

Affected versions of this package are vulnerable to SQL Injection via the class QueryGenerator. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.

CVSS Scores

version 3.1