TYPO3 allows remote attackers to obtain the database name via a direct request

MOYENNE 5.0CVE-2012-1607 · GHSA-q68v-vcjg-r3vp · Published 04/09/2012 · updated 16/06/2026

En bref

CVE-2012-1607 est une vulnérabilité MOYENNE (CVSS 5.0) touchant typo3/cms, typo3 (typo3).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.1%, plus élevée que 87.7% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
typo3/cms Packagist	`≥ 4.4.0, ≤ 4.4.13≥ 4.5.0, ≤ 4.5.13≥ 4.6.0, ≤ 4.6.6`	No fix yet
typo3 typo3	`= 4.4= 4.4.0= 4.4.1= 4.4.10= 4.4.11= 4.4.12= 4.4.13= 4.4.2= 4.4.3= 4.4.4= 4.4.5= 4.4.6= 4.4.7= 4.4.8= 4.4.9= 4.5= 4.5.0= 4.5.1= 4.5.10= 4.5.11= 4.5.12= 4.5.13= 4.5.2= 4.5.3= 4.5.4= 4.5.5= 4.5.6= 4.5.7= 4.5.8= 4.5.9= 4.6= 4.6.0= 4.6.1= 4.6.2= 4.6.3= 4.6.4= 4.6.5= 4.6.6= 4.7= 6.0`	No fix yet

Description

The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2012-1607 · ADVISORY
TYPO3/typo3 · PACKAGE
web.archive.org/web/20120426034517/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 · WEB
web.archive.org/web/20120527123559/http://www.securityfocus.com/bid/52771 · WEB
debian.org/security/2012/dsa-2445 · WEB
openwall.com/lists/oss-security/2012/03/30/4 · WEB
osvdb.org/80761
secunia.com/advisories/48622 · Vendor Advisory
secunia.com/advisories/48647 · Vendor Advisory
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 · Vendor Advisory
securityfocus.com/bid/52771

Autres vulnérabilités de typo3/cms

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free