The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| typo3/cms-core(Packagist) | 4.2.0 | 4.2.16 | N/A |
| typo3/cms-core(Packagist) | 4.3.0 | 4.3.9 | N/A |
| typo3/cms-core(Packagist) | 4.4.0 | 4.4.5 | N/A |
CVSS Metrics
