CVE-2012-6146

NameCVE-2012-6146
DescriptionThe Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2574-1
NVD severitymedium
Debian Bugs692775

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
typo3-srcsourcesqueeze4.3.9+dfsg1-1+squeeze7DSA-2574-1
typo3-srcsource(unstable)4.5.19+dfsg1-4692775

Notes

https://review.typo3.org/16304

Search for package or bug name: Reporting problems