high8.1
CVE-2013-4748
News system (news) extension for TYPO3 vulnerable to SQL Injection
Impact
SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | georgringer/news | < 1.3.3 | 1.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Georg Ringer | News | through 1.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://osvdb.org/89134
- http://typo3.org/extensions/repository/view/news
- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81192
- https://github.com/advisories/GHSA-rg6g-v4xm-g49q
- https://nvd.nist.gov/vuln/detail/CVE-2013-4748
- https://web.archive.org/web/20130214093535/http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001