CVE-2012-1607
TYPO3 allows remote attackers to obtain the database name via a direct request
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
Exploit likelihood
What each source reports
NVD Score used
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
CVE-2012-1607- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
CVE-2012-1607- Updated
- 2026-11-02
EUVDEUVD-2012-1619 No score
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
EUVD-2012-1619- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q68v-vcjg-r3vp No score
TYPO3 allows remote attackers to obtain the database name via a direct request
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
GHSA-q68v-vcjg-r3vp- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-q68v-vcjg-r3vp No score
TYPO3 allows remote attackers to obtain the database name via a direct request
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
GHSA-q68v-vcjg-r3vp- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-1607 No score
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Record
UBUNTU-CVE-2012-1607- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
4.4.0 to 4.4.13 | None known |
typo3/cmsPackagist |
4.5.0 to 4.5.13 | None known |
typo3/cmsPackagist |
4.6.0 to 4.6.6 | None known |
typo3-srcDebian:6.0 From an advisory covering 3 CVEs |
before 4.3.9+dfsg1-1+squeeze3, plus listed versions 4.3.9+dfsg1-14.3.9+dfsg1-1+squeeze14.3.9+dfsg1-1+squeeze2 |
4.3.9+dfsg1-1+squeeze3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1607 is a medium vulnerability (CVSS 5.0) in Typo3, published March 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.09%, the 87th percentile. No source names a fixed version.
References
secunia.com/advisories/48647
openwall.com/lists/oss-security/2012/03/30/4
osvdb.org/80761
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001
debian.org/security/2012/dsa-2445
Show 9 moreShow less
securityfocus.com/bid/52771
nvd.nist.gov/vuln/detail/CVE-2012-1607
web.archive.org/web/20120426034517/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001
github.com/advisories/GHSA-q68v-vcjg-r3vp
ubuntu.com/security/CVE-2012-1607
cve.org/CVERecord?id=CVE-2012-1607