GHSA-5v5h-4w2g-gxxc

SQL Injection in t3/dce

Source: GitHub Advisory Database (reviewed) High CVE-2021-31777

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	t3/dce	>= 2.2.0, < 2.6.2	2.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-31777 advisory
https://bitbucket.org/ArminVieweg/dce/commits/998a2392f69f2153797c5ace6e8914ca309e70c7 web
https://excellium-services.com/cert-xlm-advisory web
https://packagist.org/packages/t3/dce web
https://typo3.org/security/advisory/typo3-ext-sa-2021-005 web
http://packetstormsecurity.com/files/162429/TYPO3-6.2.1-SQL-Injection.html web