CVE-2019-19849
TYPO3 Insecure Deserialization in Query Generator & Query View
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
- Record
CVE-2019-19849- CVSS 3.0
- 8.8 High
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2022-5150
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
- Record
EUVD-2022-5150- CVSS 3.0
- 8.8 High
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rcgc-4xfc-564v
TYPO3 Insecure Deserialization in Query Generator & Query View
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
- Record
GHSA-rcgc-4xfc-564v- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
- Record
CVE-2019-19849- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
- Record
CVE-2019-19849- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rcgc-4xfc-564v
TYPO3 Insecure Deserialization in Query Generator & Query View
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
- Record
GHSA-rcgc-4xfc-564v- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
10.0.0 up to 10.2.1 | 10.2.1 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.30 | 8.7.30 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.12 | 9.5.12 |
typo3/cmsPackagist |
10.0.0 up to 10.2.1 | 10.2.1 |
typo3/cmsPackagist |
8.0.0 up to 8.7.30 | 8.7.30 |
typo3/cmsPackagist |
9.0.0 up to 9.5.12 | 9.5.12 |
typo3/cms-corePackagist |
10.0.0 up to 10.2.1, plus listed versions v10.0.0v10.1.0v10.2.0 |
10.2.1 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.30, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 18 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.7v8.7.8v8.7.9 |
8.7.30 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.12 |
typo3/cmsPackagist |
10.0.0 up to 10.2.1, plus listed versions v10.0.0v10.1.0v10.2.0 |
10.2.1 |
typo3/cmsPackagist |
8.0.0 up to 8.7.30, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 39 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 |
8.7.30 |
typo3/cmsPackagist |
9.0.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19849 is a high vulnerability (CVSS 8.8) in Typo3, published December 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 69th percentile. Fixed in typo3/cms-core 10.2.1.
References
typo3.org/security/advisory/typo3-core-sa-2019-026
review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:security
nvd.nist.gov/vuln/detail/CVE-2019-19849
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-19849.yaml