CVE-2010-4952: SQL Injection
Published Oct 9, 2011
·Updated
SQL injection vulnerability in the FE user statistic (festat) extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Software
5 affected components
Joachim Ruhs Festat<=0.2.0
Joachim Ruhs Festat=0.1.6
Joachim Ruhs Festat=0.1.8
Joachim Ruhs Festat=0.1.9
Typo3 TYPO3
Remediation
Patch Available
Event History
Oct 9, 2011
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
10:55 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-4952?
CVE-2010-4952 is considered to have a high severity due to its potential for remote SQL injection attacks.
2
How do I fix CVE-2010-4952?
To fix CVE-2010-4952, upgrade the FE user statistic (festat) extension to version 0.2.4 or later.
3
Who is affected by CVE-2010-4952?
CVE-2010-4952 affects users of the festat extension versions prior to 0.2.4 for TYPO3.
4
What type of vulnerability is CVE-2010-4952?
CVE-2010-4952 is an SQL injection vulnerability that allows execution of arbitrary SQL commands.
5
What should I do if I cannot upgrade for CVE-2010-4952?
If upgrading is not possible, evaluate the implementation for potential mitigation strategies against SQL injection.