Vulnerability advisory

CVE-2019-19850

Published Dec 17, 2019Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/TYPO3/typo3 ↗
a9a68ed6a41c86e6d46629c15ca4bdffe85344f1 to before 23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3	`23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3`
41235ff8e38c6f3401df03ae8beddd62d662c525 to before efd84a5a507792083f9f4ec03f8c7d580adfc3d8	`efd84a5a507792083f9f4ec03f8c7d580adfc3d8`
c91b70e450c52d29ffb08115fffbb7832b15a330 to before b7d2c8f95222abade62827244327367995345891	`b7d2c8f95222abade62827244327367995345891`
Also listed as affected (119) `v10.2.1` `v10.2.0` `v8.7.29` `TYPO3_8-7-29` `8.7.29` `v9.5.11` `v9.5.10` `v8.7.28` `TYPO3_8-7-28` `8.7.28` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v8.7.27` `TYPO3_8-7-27` `8.7.27` `v8.7.26` `TYPO3_8-7-26` `8.7.26` `v9.5.7` `v8.7.25` `TYPO3_8-7-25` `8.7.25` `v9.5.6` `v9.5.5` `v8.7.24` `TYPO3_8-7-24` `8.7.24` `v9.5.4` `v8.7.23` `TYPO3_8-7-23` `8.7.23` `v8.7.22` `TYPO3_8-7-22` `8.7.22` `v9.5.3` `v9.5.2` `v8.7.21` `TYPO3_8-7-21` `8.7.21` `v9.5.1` `v8.7.20` `TYPO3_8-7-20` `8.7.20` `v9.5.0` `v9.4.0` `v8.7.19` `TYPO3_8-7-19` `8.7.19` `v8.7.18` `TYPO3_8-7-18` `8.7.18` `v8.7.17` `TYPO3_8-7-17` `8.7.17` `v9.3.0` `v8.7.16` `TYPO3_8-7-16` `8.7.16` `v8.7.15` `TYPO3_8-7-15` `8.7.15` `v8.7.14` `TYPO3_8-7-14` `8.7.14` `v9.2.0` `v8.7.13` `TYPO3_8-7-13` `8.7.13` `v8.7.12` `TYPO3_8-7-12` `8.7.12` `v8.7.11` `TYPO3_8-7-11` `8.7.11` `v8.7.10` `TYPO3_8-7-10` `8.7.10` `v9.1.0` `v9.0.0` `v8.7.9` `TYPO3_8-7-9` `8.7.9` `v8.7.8` `TYPO3_8-7-8` `8.7.8` `v8.7.7` `TYPO3_8-7-7` `8.7.7` `v8.7.6` `TYPO3_8-7-6` `8.7.6` `v8.7.5` `TYPO3_8-7-5` `8.7.5` `v8.7.4` `TYPO3_8-7-4` `8.7.4` `TYPO3_8-7-2` `8.7.2` `TYPO3_8-7-1` `8.7.1` `TYPO3_8-7-0` `8.7.0` `TYPO3_8-6-0` `8.6.0` `TYPO3_8-5-0` `8.5.0` `TYPO3_8-4-0` `8.4.0` `TYPO3_8-3-0` `8.3.0` `TYPO3_8-2-0` `8.2.0` `TYPO3_8-1-0` `8.1.0` `TYPO3_8-0-0` `8.0.0`
GIT github.com/typo3/typo3 ↗
a9a68ed6a41c86e6d46629c15ca4bdffe85344f1 to before 23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3	`23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3`
41235ff8e38c6f3401df03ae8beddd62d662c525 to before efd84a5a507792083f9f4ec03f8c7d580adfc3d8	`efd84a5a507792083f9f4ec03f8c7d580adfc3d8`
c91b70e450c52d29ffb08115fffbb7832b15a330 to before b7d2c8f95222abade62827244327367995345891	`b7d2c8f95222abade62827244327367995345891`
Also listed as affected (119) `v10.2.1` `v10.2.0` `v8.7.29` `TYPO3_8-7-29` `8.7.29` `v9.5.11` `v9.5.10` `v8.7.28` `TYPO3_8-7-28` `8.7.28` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v8.7.27` `TYPO3_8-7-27` `8.7.27` `v8.7.26` `TYPO3_8-7-26` `8.7.26` `v9.5.7` `v8.7.25` `TYPO3_8-7-25` `8.7.25` `v9.5.6` `v9.5.5` `v8.7.24` `TYPO3_8-7-24` `8.7.24` `v9.5.4` `v8.7.23` `TYPO3_8-7-23` `8.7.23` `v8.7.22` `TYPO3_8-7-22` `8.7.22` `v9.5.3` `v9.5.2` `v8.7.21` `TYPO3_8-7-21` `8.7.21` `v9.5.1` `v8.7.20` `TYPO3_8-7-20` `8.7.20` `v9.5.0` `v9.4.0` `v8.7.19` `TYPO3_8-7-19` `8.7.19` `v8.7.18` `TYPO3_8-7-18` `8.7.18` `v8.7.17` `TYPO3_8-7-17` `8.7.17` `v9.3.0` `v8.7.16` `TYPO3_8-7-16` `8.7.16` `v8.7.15` `TYPO3_8-7-15` `8.7.15` `v8.7.14` `TYPO3_8-7-14` `8.7.14` `v9.2.0` `v8.7.13` `TYPO3_8-7-13` `8.7.13` `v8.7.12` `TYPO3_8-7-12` `8.7.12` `v8.7.11` `TYPO3_8-7-11` `8.7.11` `v8.7.10` `TYPO3_8-7-10` `8.7.10` `v9.1.0` `v9.0.0` `v8.7.9` `TYPO3_8-7-9` `8.7.9` `v8.7.8` `TYPO3_8-7-8` `8.7.8` `v8.7.7` `TYPO3_8-7-7` `8.7.7` `v8.7.6` `TYPO3_8-7-6` `8.7.6` `v8.7.5` `TYPO3_8-7-5` `8.7.5` `v8.7.4` `TYPO3_8-7-4` `8.7.4` `TYPO3_8-7-2` `8.7.2` `TYPO3_8-7-1` `8.7.1` `TYPO3_8-7-0` `8.7.0` `TYPO3_8-6-0` `8.6.0` `TYPO3_8-5-0` `8.5.0` `TYPO3_8-4-0` `8.4.0` `TYPO3_8-3-0` `8.3.0` `TYPO3_8-2-0` `8.2.0` `TYPO3_8-1-0` `8.1.0` `TYPO3_8-0-0` `8.0.0`

Description

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.

CVE-2019-19850

Affected versions

Repository

Description

References