Vulnerability advisory
GHSA-947m-vgqc-x6v4
Typo3 Backend History Module Vulnerable to SQL Injection
Also known as CVE-2012-6144
Severity
Severity not reported.
Affected versions
typo3/cms Packagist
All typo3/cms advisories →| Affected | Fixed in |
|---|---|
4.5.0 to before 4.5.21 | 4.5.21Advisories → |
4.6.0 to before 4.6.14 | 4.6.14Advisories → |
4.7.0 to before 4.7.6 | 4.7.6Advisories → |
Description
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.