GHSA-rg6g-v4xm-g49qhigh8.1
News system (news) extension for TYPO3 vulnerable to SQL Injection
Impact
SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
georgringer/news Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.3.3Ecosystem versions | 1.3.3 |
Version evidence: OSV · GHSA-rg6g-v4xm-g49q
View original version evidence (0 explicit versions)
Original source description
SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2013-4748
- Security advisory exchange.xforce.ibmcloud.com/vulnerabilities/81192
- Source reference github.com/georgringer/news
- Security advisory web.archive.org/web/20130214093535/http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001
- Source reference typo3.org/extensions/repository/view/news