Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-947m-vgqc-x6v4
Advisory ID github_osv/GHSA-947m-vgqc-x6v4
Aliases CVE-2012-6144
Summary Typo3 Backend History Module Vulnerable to SQL Injection SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
https://exchange.xforce.ibmcloud.com/vulnerabilities/79964
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005
http://www.openwall.com/lists/oss-security/2013/06/19/4
CVE-2012-6144 https://nvd.nist.gov/vuln/detail/CVE-2012-6144
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.