CVE-2010-5104
TYPO3 Sensitive Information Disclosure via escapeStrForLike method
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
Exploit likelihood
What each source reports
NVD Score used
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
- Record
CVE-2010-5104- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
- Record
CVE-2010-5104- Updated
- 2026-11-02
EUVDEUVD-2022-5782 No score
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
- Record
EUVD-2022-5782- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgc2-q928-27wv No score
TYPO3 Sensitive Information Disclosure via escapeStrForLike method
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
- Record
GHSA-xgc2-q928-27wv- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-xgc2-q928-27wv No score
TYPO3 Sensitive Information Disclosure via escapeStrForLike method
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
- Record
GHSA-xgc2-q928-27wv- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
4.2.0 up to 4.2.16 | 4.2.16 |
typo3/cms-corePackagist |
4.3.0 up to 4.3.9 | 4.3.9 |
typo3/cms-corePackagist |
4.4.0 up to 4.4.5 | 4.4.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-5104 is a medium vulnerability (CVSS 4.3) in Typo3, published May 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in typo3/cms-core 4.2.16.
References
typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022
securityfocus.com/bid/45470
secunia.com/advisories/35770
openwall.com/lists/oss-security/2012/05/12/5
osvdb.org/70116
Show 12 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/64185
nvd.nist.gov/vuln/detail/CVE-2010-5104
github.com/TYPO3/typo3/commit/9eb4be4ccf10e6959699b9cce375d48697f06cba
web.archive.org/web/20101219052359/http://secunia.com/advisories/35770