CVE-2012-1607

TYPO3 allows remote attackers to obtain the database name via a direct request

5.0 MediumFix available

CVE-2012-1607 is a medium vulnerability (CVSS 5.0) in Typo3, published March 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.09%, the 87th percentile. Fixed in typo3-src 4.3.9+dfsg1-1+squeeze3.

The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.

Exploit likelihood

3.09%Up 1.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2012-1607
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-1607
Updated: 2026-11-02

EUVDEUVD-2012-1619 No score

Record: EUVD-2012-1619
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q68v-vcjg-r3vp No score

TYPO3 allows remote attackers to obtain the database name via a direct request

Record: GHSA-q68v-vcjg-r3vp
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-q68v-vcjg-r3vp No score

TYPO3 allows remote attackers to obtain the database name via a direct request

Record: GHSA-q68v-vcjg-r3vp
Weakness: CWE-200
Updated: 2026-11-02

OSVUBUNTU-CVE-2012-1607 No score

Record: UBUNTU-CVE-2012-1607
Updated: 2026-11-02

Affected products

typo3

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms` Packagist	4.4.0 to 4.4.13	None known
`typo3/cms` Packagist	4.5.0 to 4.5.13	None known
`typo3/cms` Packagist	4.6.0 to 4.6.6	None known
`typo3-src` Debian:6.0	before 4.3.9+dfsg1-1+squeeze3, plus listed versions 4.3.9+dfsg1-14.3.9+dfsg1-1+squeeze14.3.9+dfsg1-1+squeeze2	4.3.9+dfsg1-1+squeeze3

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less