CVE-2011-3583: SQL Injection
Published Nov 25, 2019
·Updated
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.
Affected Software
3 affected components
debian/typo3-src
composer/typo3/cms>=4.5.0<=4.5.5
Typo3 TYPO3>=4.5.0<=4.5.5
Event History
Nov 25, 2019
CVE Published
via MITRE·11:21 PM
Data Sourced
via MITRE·11:21 PM
DescriptionWeakness
Apr 22, 2022
Advisory Published
via GitHub·12:24 AM
Frequently Asked Questions
1
What is CVE-2011-3583?
CVE-2011-3583 is a SQL Injection vulnerability in Typo3 Core versions 4.5.0 - 4.5.5.
2
How does CVE-2011-3583 work?
CVE-2011-3583 exploits the use of prepared statements in Typo3, where improper replacement of parameter values can allow an attacker to inject malicious SQL code.
3
What is the severity of CVE-2011-3583?
CVE-2011-3583 has a severity rating of 9.8 out of 10, making it critical.
4
Which software versions are affected by CVE-2011-3583?
Typo3 Core versions 4.5.0 - 4.5.5 are affected by CVE-2011-3583.
5
How can CVE-2011-3583 be fixed?
Update Typo3 Core to a version beyond 4.5.5 to fix CVE-2011-3583.