NVD Vulnerability Detail

CVE-2012-1607

Summary	The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
Publication Date	Sept. 5, 2012, 5:55 a.m.
Registration Date	Jan. 28, 2021, 2:55 p.m.
Last Update	Nov. 21, 2024, 10:37 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://osvdb.org/80761
2	http://osvdb.org/80761
3	http://secunia.com/advisories/48622	Vendor Advisory
4	http://secunia.com/advisories/48622	Vendor Advisory
5	http://secunia.com/advisories/48647	Vendor Advisory
6	http://secunia.com/advisories/48647	Vendor Advisory
7	http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/	Vendor Advisory
8	http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/	Vendor Advisory
9	http://www.debian.org/security/2012/dsa-2445
10	http://www.debian.org/security/2012/dsa-2445
11	http://www.openwall.com/lists/oss-security/2012/03/30/4
12	http://www.openwall.com/lists/oss-security/2012/03/30/4
13	http://www.securityfocus.com/bid/52771
14	http://www.securityfocus.com/bid/52771

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

TYPO3 の Command Line Interface スクリプトにおけるデータベース名を取得される脆弱性

Title	TYPO3 の Command Line Interface スクリプトにおけるデータベース名を取得される脆弱性
Summary	TYPO3 の Command Line Interface (CLI) スクリプトには、データベース名を取得される脆弱性が存在します。
Possible impacts	第三者により、直接のリクエストされることで、データベース名を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 28, 2012, midnight
Registration Date	Sept. 6, 2012, 11:15 a.m.
Last Update	Sept. 6, 2012, 11:15 a.m.

Affected System

TYPO3 Association

TYPO3 4.4.0 から 4.4.13

TYPO3 4.5.0 から 4.5.13

TYPO3 4.6.0 から 4.6.6

TYPO3 4.7

TYPO3 6.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-1607	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1607
National Vulnerability Database (NVD)
2	CVE-2012-1607	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1607

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2445	http://www.debian.org/security/2012/dsa-2445
TYPO3
2	TYPO3 4.4.15, 4.5.15 and 4.6.8 released	http://typo3.org/news/article/typo3-4415-4515-and-468-released/
TYPO3 Security Bulletin
3	TYPO3-CORE-SA-2012-001	http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/

Change Log

No	Changed Details	Date of change
0	[2012年09月06日] 掲載	Feb. 17, 2018, 10:37 a.m.