Lucene search

RedhatCVE-2010-5104

HistoryMay 21, 2012 - 8:55 p.m.

CVE-2010-5104

2012-05-2120:55:17

CWE-200

redhat

web.nvd.nist.gov

typo3

escapestrforlike

vulnerability

mysql

sql_mode

no_backslash_escapes

remote attackers

sensitive information

nvd

cve-2010-5104

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.1

Confidence

Low

EPSS

0.007

Percentile

79.8%

JSON

The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.

Affected configurations

Nvd

Node

typo3typo3Match4.2.0

typo3typo3Match4.2.1

typo3typo3Match4.2.2

typo3typo3Match4.2.3

typo3typo3Match4.2.4

typo3typo3Match4.2.5

typo3typo3Match4.2.6

typo3typo3Match4.2.7

typo3typo3Match4.2.8

typo3typo3Match4.2.9

typo3typo3Match4.2.10

typo3typo3Match4.2.11

typo3typo3Match4.2.12

typo3typo3Match4.2.13

typo3typo3Match4.2.14

typo3typo3Match4.2.15

typo3typo3Match4.3.0

typo3typo3Match4.3.1

typo3typo3Match4.3.2

typo3typo3Match4.3.3

typo3typo3Match4.3.4

typo3typo3Match4.3.5

typo3typo3Match4.3.6

typo3typo3Match4.3.7

typo3typo3Match4.3.8

typo3typo3Match4.4.1

typo3typo3Match4.4.2

typo3typo3Match4.4.3

typo3typo3Match4.4.4

VendorProductVersionCPE
typo3typo34.2.0cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*
typo3typo34.2.1cpe:2.3:a:typo3:typo3:4.2.1:*:*:*:*:*:*:*
typo3typo34.2.2cpe:2.3:a:typo3:typo3:4.2.2:*:*:*:*:*:*:*
typo3typo34.2.3cpe:2.3:a:typo3:typo3:4.2.3:*:*:*:*:*:*:*
typo3typo34.2.4cpe:2.3:a:typo3:typo3:4.2.4:*:*:*:*:*:*:*
typo3typo34.2.5cpe:2.3:a:typo3:typo3:4.2.5:*:*:*:*:*:*:*
typo3typo34.2.6cpe:2.3:a:typo3:typo3:4.2.6:*:*:*:*:*:*:*
typo3typo34.2.7cpe:2.3:a:typo3:typo3:4.2.7:*:*:*:*:*:*:*
typo3typo34.2.8cpe:2.3:a:typo3:typo3:4.2.8:*:*:*:*:*:*:*
typo3typo34.2.9cpe:2.3:a:typo3:typo3:4.2.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3	4.2.0	cpe:2.3:a:typo3:typo3:4.2.0:::::::*
typo3	typo3	4.2.1	cpe:2.3:a:typo3:typo3:4.2.1:::::::*
typo3	typo3	4.2.2	cpe:2.3:a:typo3:typo3:4.2.2:::::::*
typo3	typo3	4.2.3	cpe:2.3:a:typo3:typo3:4.2.3:::::::*
typo3	typo3	4.2.4	cpe:2.3:a:typo3:typo3:4.2.4:::::::*
typo3	typo3	4.2.5	cpe:2.3:a:typo3:typo3:4.2.5:::::::*
typo3	typo3	4.2.6	cpe:2.3:a:typo3:typo3:4.2.6:::::::*
typo3	typo3	4.2.7	cpe:2.3:a:typo3:typo3:4.2.7:::::::*
typo3	typo3	4.2.8	cpe:2.3:a:typo3:typo3:4.2.8:::::::*
typo3	typo3	4.2.9	cpe:2.3:a:typo3:typo3:4.2.9:::::::*