CVE-2012-6146

NameCVE-2012-6146
DescriptionThe Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2574-1
NVD severitymedium (attack range: remote)
Debian Bugs692775

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
typo3-src (PTS)wheezy (security)4.5.19+dfsg1-5+wheezy4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
typo3-srcsource(unstable)4.5.19+dfsg1-4medium692775
typo3-srcsourcesqueeze4.3.9+dfsg1-1+squeeze7mediumDSA-2574-1

Notes

https://review.typo3.org/16304
Search for package or bug name: Reporting problems