CVE-2012-1607: TYPO3 CMS Database Name Exposure Vulnerability
Summary
CVE-2012-1607: TYPO3 allows remote attackers to obtain the database name via a direct request. Affects typo3/cms across 3 version ranges.
>= 4.4.0, <= 4.4.13
>= 4.5.0, <= 4.5.13
>= 4.6.0, <= 4.6.6
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) designed for enterprise-level websites. It offers a wide range of features including extensibility, user management, and multilingual support. However, certain versions of TYPO3 are vulnerable to a security flaw that allows remote attackers to access sensitive information, specifically the database name, through direct requests to the Command Line Interface (CLI) script.
Vulnerability Detail
The vulnerability identified as CVE-2012-1607 affects TYPO3 versions 4.4.0 to 4.4.13, 4.5.0 to 4.5.13, 4.6.0 to 4.6.6, 4.7, and 6.0. It allows remote attackers to obtain the database name via a direct request to the CLI script. This exposure can lead to further attacks, as the database name is a critical piece of information that could facilitate unauthorized access to the database itself, potentially compromising sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the CLI script by implementing firewall rules or server configurations that limit access to trusted IP addresses only. This can help mitigate the risk of unauthorized access while a permanent fix is being applied.
Conclusion
The CVE-2012-1607 vulnerability in TYPO3 poses a significant risk by exposing the database name to remote attackers. It is crucial for users of affected versions to update their installations to secure versions promptly. Implementing access restrictions can serve as a temporary measure while a permanent fix is applied.
See every vulnerability recorded for typo3/cms →
FAQ
CVE-2012-1607 is a vulnerability in TYPO3 that allows remote attackers to obtain the database name through direct requests to the CLI script.
The affected versions include TYPO3 4.4.0 to 4.4.13, 4.5.0 to 4.5.13, 4.6.0 to 4.6.6, 4.7, and 6.0.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your composer.lock file, Vulert can alert you in real-time if your application is affected by this vulnerability.
Update your TYPO3 installation to the latest patched version and consider implementing access restrictions to the CLI script as a temporary measure.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
