Description

The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.

Remediation

References

CVE-2010-5104

Related Vulnerabilities

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-29039)

WordPress Plugin WordPress for Google Maps-WP MAPS Cross-Site Scripting (4.0.3)

WordPress Plugin Archive Posts Sort Customize Cross-Site Scripting (1.5)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-4567)

WordPress Plugin Unite Gallery Lite Multiple Vulnerabilities (1.4.6)

Severity

Medium

Classification

CVE-2010-5104 CWE-200

Tags

Missing Update Known Vulnerabilities