CVE-2009-2106

SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-007/	Patch Vendor Advisory
http://typo3.org/extensions/repository/view/civserv/4.3.3/	Patch
http://secunia.com/advisories/35479	Patch Vendor Advisory
http://osvdb.org/55121
http://www.securityfocus.com/bid/35395

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

OR	cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services::::::::
	cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:4.3.0:::::::*
	cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:4.2.15:::::::*
	cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:4.2.14:::::::*

Information

Published : 2009-06-17 10:30

Updated : 2009-07-01 20:31

NVD link : CVE-2009-2106

Mitre link : CVE-2009-2106

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Products Affected

projektseminar_proservice_wwu

virtual_civil_services

typo3

typo3

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-007/", "name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-007/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://typo3.org/extensions/repository/view/civserv/4.3.3/", "name": "http://typo3.org/extensions/repository/view/civserv/4.3.3/", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/35479", "name": "35479", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/55121", "name": "55121", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/bid/35395", "name": "35395", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-2106", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-06-17T17:30Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.3.2"}, {"cpe23Uri": "cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:4.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:4.2.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:projektseminar_proservice_wwu:virtual_civil_services:4.2.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2009-07-02T03:31Z"}

7.5 /10