CVE-2019-19850

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2

Medium · published December 17, 2019

CVSS v3.0
5.5
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.

The record
Technical detail
CVSS v3.0
5.5 · MEDIUM
Vector
CVSS:3.0/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00868 · 58.3th percentile
Published
2019-12-17T16:03Z
EPSS history
Timeline
  • 17 DEC 16:03Z
    An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2
    cvelistv5