Description
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-core | >= 4.2.0, < 4.2.16 | 4.2.16 | GHSA-xgc2-q928-27wv |
| Packagist | typo3/cms-core | >= 4.3.0, < 4.3.9 | 4.3.9 | GHSA-xgc2-q928-27wv |
| Packagist | typo3/cms-core | >= 4.4.0, < 4.4.5 | 4.4.5 | GHSA-xgc2-q928-27wv |
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/
- 45470 vdb-entry
- 35770 third-party-advisory
- [oss-security] 20120512 Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE mailing-list
- [oss-security] 20110113 CVE requests: ftpls, xdigger, lbreakout2, calibre, typo3 mailing-list
- 70116 vdb-entry
- [oss-security] 20120510 Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE mailing-list
- typo3-escapestrforlike-info-disc(64185) vdb-entry
- [oss-security] 20120511 CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE mailing-list