Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:composer/typo3/cms-install@4.2.0

Type composer

Namespace typo3

Name cms-install

Version 4.2.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 4.2.10

Latest_non_vulnerable_version 12.4.8

Affected_by_vulnerabilities

url VCID-jv8p-qvwg-k3eq

vulnerability_id VCID-jv8p-qvwg-k3eq

summary

Session Fixation
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session.

references

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719
reference_id
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719

reference_url	https://github.com/TYPO3/typo3/commit/199cc2d53747d76657d7aab612c6b3f728d0f15d
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/199cc2d53747d76657d7aab612c6b3f728d0f15d

reference_url	https://github.com/TYPO3/typo3/commit/1d649976e1f1bda684cdc7120e9f74a543059181
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/1d649976e1f1bda684cdc7120e9f74a543059181

reference_url	https://github.com/TYPO3/typo3/commit/d3577c8e2c49122c4ab5955c70688ee441d06f23
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/d3577c8e2c49122c4ab5955c70688ee441d06f23

reference_url	https://github.com/TYPO3/typo3/commit/ef3676281b0346644041a93fcbaa7bd9844bbbc5
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/ef3676281b0346644041a93fcbaa7bd9844bbbc5

reference_url	https://typo3.org/security/advisory/typo3-sa-2010-012/#Broken_Authentication_and_Session_Management
reference_id
reference_type
scores
url	https://typo3.org/security/advisory/typo3-sa-2010-012/#Broken_Authentication_and_Session_Management

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2010-3671
reference_id	CVE-2010-3671
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2010-3671

reference_url	https://security-tracker.debian.org/tracker/CVE-2010-3671
reference_id	CVE-2010-3671
reference_type
scores
url	https://security-tracker.debian.org/tracker/CVE-2010-3671

reference_url	https://github.com/advisories/GHSA-gqmh-5xmq-3fhg
reference_id	GHSA-gqmh-5xmq-3fhg
reference_type
scores
url	https://github.com/advisories/GHSA-gqmh-5xmq-3fhg

fixed_packages

url	pkg:composer/typo3/cms-install@4.2.13
purl	pkg:composer/typo3/cms-install@4.2.13
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.2.13

url	pkg:composer/typo3/cms-install@4.3.4
purl	pkg:composer/typo3/cms-install@4.3.4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.3.4

url	pkg:composer/typo3/cms-install@4.4.1
purl	pkg:composer/typo3/cms-install@4.4.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.4.1

aliases CVE-2010-3671, GHSA-gqmh-5xmq-3fhg

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jv8p-qvwg-k3eq

url VCID-mw92-826g-s7aa

vulnerability_id VCID-mw92-826g-s7aa

summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

references

reference_url	http://marc.info/?l=oss-security&m=125632856206736&w=2
reference_id
reference_type
scores
url	http://marc.info/?l=oss-security&m=125632856206736&w=2

reference_url	http://marc.info/?l=oss-security&m=125633199111438&w=2
reference_id
reference_type
scores
url	http://marc.info/?l=oss-security&m=125633199111438&w=2

reference_url	https://exchange.xforce.ibmcloud.com/vulnerabilities/53929
reference_id
reference_type
scores
url	https://exchange.xforce.ibmcloud.com/vulnerabilities/53929

reference_url	https://web.archive.org/web/20101223093042/http://www.securityfocus.com/bid/36801
reference_id
reference_type
scores
url	https://web.archive.org/web/20101223093042/http://www.securityfocus.com/bid/36801

reference_url	http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/
reference_id
reference_type
scores
url	http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2009-3636
reference_id	CVE-2009-3636
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2009-3636

reference_url	https://github.com/advisories/GHSA-c73w-4rcj-2622
reference_id	GHSA-c73w-4rcj-2622
reference_type
scores
url	https://github.com/advisories/GHSA-c73w-4rcj-2622

fixed_packages

url	pkg:composer/typo3/cms-install@4.2.10
purl	pkg:composer/typo3/cms-install@4.2.10
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.2.10

url	pkg:composer/typo3/cms-install@4.3.0-beta2
purl	pkg:composer/typo3/cms-install@4.3.0-beta2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.3.0-beta2

aliases CVE-2009-3636, GHSA-c73w-4rcj-2622

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mw92-826g-s7aa

url VCID-spfb-gnjs-97cq

vulnerability_id VCID-spfb-gnjs-97cq

summary

Use of Insufficiently Random Values
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.

references

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719
reference_id
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719

reference_url	https://github.com/TYPO3/typo3/commit/302b35e714ca30ddb71ab36b9cbb2bea760a2f0e
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/302b35e714ca30ddb71ab36b9cbb2bea760a2f0e

reference_url	https://github.com/TYPO3/typo3/commit/352d6066bf09137e86705bc060fd4ab3ba8f9191
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/352d6066bf09137e86705bc060fd4ab3ba8f9191

reference_url	https://github.com/TYPO3/typo3/commit/42324b30546b1e49fb16c916fc71cceb99ad9fd0
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/42324b30546b1e49fb16c916fc71cceb99ad9fd0

reference_url	https://github.com/TYPO3/typo3/commit/f6d2e33cfab87c9e44eca275d6755be747e3cd7e
reference_id
reference_type
scores
url	https://github.com/TYPO3/typo3/commit/f6d2e33cfab87c9e44eca275d6755be747e3cd7e

reference_url	https://typo3.org/security/advisory/typo3-sa-2010-012/#Insecure_Randomness
reference_id
reference_type
scores
url	https://typo3.org/security/advisory/typo3-sa-2010-012/#Insecure_Randomness

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2010-3666
reference_id	CVE-2010-3666
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2010-3666

reference_url	https://security-tracker.debian.org/tracker/CVE-2010-3666
reference_id	CVE-2010-3666
reference_type
scores
url	https://security-tracker.debian.org/tracker/CVE-2010-3666

reference_url	https://github.com/advisories/GHSA-c7xr-736p-29j3
reference_id	GHSA-c7xr-736p-29j3
reference_type
scores
url	https://github.com/advisories/GHSA-c7xr-736p-29j3

fixed_packages

url	pkg:composer/typo3/cms-install@4.2.13
purl	pkg:composer/typo3/cms-install@4.2.13
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.2.13

url	pkg:composer/typo3/cms-install@4.3.4
purl	pkg:composer/typo3/cms-install@4.3.4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.3.4

url	pkg:composer/typo3/cms-install@4.4.1
purl	pkg:composer/typo3/cms-install@4.4.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.4.1

aliases CVE-2010-3666, GHSA-c7xr-736p-29j3

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-spfb-gnjs-97cq

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-install@4.2.0

Package Instance