CVE-2011-3583

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
TYPO3 Core	TYPO3 Core	4.5.0 - 4.5.5

References

https://access.redhat.com/security/cve/cve-2011-3583Broken Link
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641682Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3583Third Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2011-002/Vendor Advisory
https://access.redhat.com/security/cve/cve-2011-3583Broken Link
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641682Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3583Third Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2011-002/Vendor Advisory

Timeline

Published: Nov 26, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-35849.8The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input.CVE-2011-35854.7Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mou CVE-2011-35879.3Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attacke CVE-2011-35885.7The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x befo CVE-2011-35895.7The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in CVE-2011-35905.7The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in CVE-2011-35913.5Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary we CVE-2011-35923.5Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow CVE-2011-35935.7A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Li CVE-2011-35944.3The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other product CVE-2011-35955.4Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and au CVE-2011-35967.5Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.