CVE-2010-5104: Infoleak
Published May 21, 2012
·Updated
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sqlmode NOBACKSLASHESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
Affected Software
32 affected componentsFixes available
composer/typo3/cms-core>=4.4.0<4.4.5
4.4.5
composer/typo3/cms-core>=4.3.0<4.3.9
4.3.9
composer/typo3/cms-core>=4.2.0<4.2.16
4.2.16
Typo3 TYPO3=4.2.10
Typo3 TYPO3=4.3.6
Typo3 TYPO3=4.2.14
Typo3 TYPO3=4.3.5
Typo3 TYPO3=4.3.8
Typo3 TYPO3=4.2.4
Typo3 TYPO3=4.2.5
Typo3 TYPO3=4.2.15
Typo3 TYPO3=4.2.11
Typo3 TYPO3=4.2.0
Typo3 TYPO3=4.3.7
Typo3 TYPO3=4.2.8
Typo3 TYPO3=4.2.13
Typo3 TYPO3=4.2.3
Typo3 TYPO3=4.4.4
Typo3 TYPO3=4.2.1
Typo3 TYPO3=4.3.2
Typo3 TYPO3=4.4.1
Typo3 TYPO3=4.4.2
Typo3 TYPO3=4.2.12
Typo3 TYPO3=4.2.6
Typo3 TYPO3=4.3.0
Typo3 TYPO3=4.2.2
Typo3 TYPO3=4.3.3
Typo3 TYPO3=4.3.4
Typo3 TYPO3=4.3.1
Typo3 TYPO3=4.2.7
Typo3 TYPO3=4.4.3
Typo3 TYPO3=4.2.9
Event History
May 21, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·01:55 AM
Frequently Asked Questions
1
What is the severity of CVE-2010-5104?
CVE-2010-5104 has a medium severity level due to its potential to expose sensitive information.
2
How do I fix CVE-2010-5104?
To fix CVE-2010-5104, upgrade TYPO3 to version 4.2.16, 4.3.9, or 4.4.5 or later.
3
What versions of TYPO3 are affected by CVE-2010-5104?
CVE-2010-5104 affects TYPO3 versions prior to 4.2.16, 4.3.9, and 4.4.5.
4
Can CVE-2010-5104 be exploited remotely?
Yes, CVE-2010-5104 can be exploited remotely by sending specially crafted requests.
5
What kind of information can be exposed due to CVE-2010-5104?
CVE-2010-5104 can potentially expose sensitive data through the use of wildcard characters in SQL LIKE queries.