CVE-2012-1607
TYPO3 allows remote attackers to obtain the database name via a direct request
CVE-2012-1607 is a medium vulnerability (CVSS 5.0) in Typo3, published March 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.09%, the 87th percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 3.09%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 4.4.0 to 4.4.13 | None known |
typo3/cmsPackagist | 4.5.0 to 4.5.13 | None known |
typo3/cmsPackagist | 4.6.0 to 4.6.6 | None known |
typo3-srcDebian:6.0 From an advisory covering 3 CVEs | before 4.3.9+dfsg1-1+squeeze3, plus listed versions 4.3.9+dfsg1-14.3.9+dfsg1-1+squeeze14.3.9+dfsg1-1+squeeze2 | 4.3.9+dfsg1-1+squeeze3 |
What each source reports
NVD Score used
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
CVE-2012-1607- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
CVE-2012-1607- Updated
- 2026-11-02
EUVDEUVD-2012-1619No score
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
EUVD-2012-1619- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q68v-vcjg-r3vpNo score
TYPO3 allows remote attackers to obtain the database name via a direct request
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
GHSA-q68v-vcjg-r3vp- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-q68v-vcjg-r3vpNo score
TYPO3 allows remote attackers to obtain the database name via a direct request
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
GHSA-q68v-vcjg-r3vp- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-1607No score
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
UBUNTU-CVE-2012-1607- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/48647
openwall.com/lists/oss-security/2012/03/30/4
osvdb.org/80761
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001
debian.org/security/2012/dsa-2445
Show 9 moreShow less
securityfocus.com/bid/52771
nvd.nist.gov/vuln/detail/CVE-2012-1607
web.archive.org/web/20120426034517/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001
github.com/advisories/GHSA-q68v-vcjg-r3vp
ubuntu.com/security/CVE-2012-1607
cve.org/CVERecord?id=CVE-2012-1607