{"id":"CVE-2010-5104","aliases":["EUVD-2022-5782","GHSA-xgc2-q928-27wv"],"status":"published","title":"TYPO3 Sensitive Information Disclosure via escapeStrForLike method","description":"The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01648,"percentile":0.76644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2012-05-21T20:00:00Z","modified":"2026-06-16T23:26:08Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms-core","fixed_in":["4.2.16","4.3.9","4.4.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.16"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.16"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.5"}]}]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/45470","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/35770","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2012/05/12/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2011/01/13/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.osvdb.org/70116","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2012/05/11/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/64185","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/05/10/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-5104","tags":["advisory"]},{"url":"https://github.com/TYPO3/typo3/commit/9eb4be4ccf10e6959699b9cce375d48697f06cba","tags":["web"]},{"url":"https://github.com/TYPO3/typo3/commit/e8c32474a5571336681243465f42090cf056054f","tags":["web"]},{"url":"https://github.com/TYPO3/typo3/commit/fcabd2fc2aa557c94805f7505277185c4abb68ab","tags":["web"]},{"url":"https://web.archive.org/web/20101219052359/http://secunia.com/advisories/35770","tags":["web"]},{"url":"https://web.archive.org/web/20111025222220/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-022/"},{"url":"https://web.archive.org/web/20111223211753/http://www.securityfocus.com/bid/45470","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xgc2-q928-27wv"},{"url":"https://github.com/TYPO3-CMS/core","tags":["package"]},{"url":"https://web.archive.org/web/20111025222220/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-022","tags":["web"]},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2010-5104","description":"The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.","status":"published","published":"2012-05-21T20:00:00Z","modified":"2024-08-07T04:09:39.215Z","updated_at":"2026-11-02T14:33:26.665532Z"}],"euvd":[{"id":"EUVD-2022-5782","description":"The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.","status":"published","published":"2012-05-21T20:00:00Z","modified":"2024-08-07T04:09:39Z","updated_at":"2026-11-03T01:39:28.123124Z"}],"ghsa":[{"id":"GHSA-xgc2-q928-27wv","title":"TYPO3 Sensitive Information Disclosure via escapeStrForLike method","description":"The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.","status":"published","published":"2022-05-17T01:55:53Z","modified":"2024-02-07T23:31:06Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:36.777238Z"}],"nvd":[{"id":"CVE-2010-5104","description":"The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.","status":"published","published":"2012-05-21T20:55:17.617Z","modified":"2026-06-16T23:26:08.85Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:04.520133Z"}],"osv":[{"id":"GHSA-xgc2-q928-27wv","title":"TYPO3 Sensitive Information Disclosure via escapeStrForLike method","description":"The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.","status":"published","published":"2022-05-17T01:55:53Z","modified":"2024-02-08T00:11:47.019067Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}