CVE-2009-4954: SQL Injection
Published Jul 22, 2010
·Updated
SQL injection vulnerability in the Versatile Calendar Extension [VCE] (skcalendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Software
10 affected components
Websedit Sk Calendar<=0.3.3
Websedit Sk Calendar=0.1.0
Websedit Sk Calendar=0.1.1
Websedit Sk Calendar=0.2.0
Websedit Sk Calendar=0.2.1
Websedit Sk Calendar=0.2.2
Websedit Sk Calendar=0.3.0
Websedit Sk Calendar=0.3.1
Websedit Sk Calendar=0.3.2
Typo3 TYPO3
Remediation
Event History
Jul 22, 2010
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
06:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-4954?
CVE-2009-4954 is a high severity SQL injection vulnerability that can allow attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2009-4954?
To fix CVE-2009-4954, update the Versatile Calendar Extension [VCE] to version 0.3.4 or later.
3
Which versions of the Versatile Calendar Extension are affected by CVE-2009-4954?
Versions of the Versatile Calendar Extension prior to 0.3.4 are affected by CVE-2009-4954.
4
What type of attack is possible with CVE-2009-4954?
CVE-2009-4954 allows remote attackers to perform SQL injection attacks, potentially compromising the database.
5
Is TYPO3 itself affected by CVE-2009-4954?
No, TYPO3 itself is not affected by CVE-2009-4954; only the Versatile Calendar Extension [VCE] has the vulnerability.