CVE-2019-19849 — TYPO3 Insecure Deserialization in typo3/cms — CVE...

HIGH

TYPO3 Insecure Deserialization in Query Generator & Query View

Published May 24, 2022Updated April 25, 2024Source: osv

Summary

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.

Advisory Timeline

First published May 24, 2022 (1602 days ago).
Last revised April 25, 2024 — 702 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update typo3/cms to 9.5.12 or later

composer require "typo3/cms:^9.5.12"

Composer

Update typo3/cms-core to 9.5.12 or later

composer require "typo3/cms-core:^9.5.12"

Composer

Update typo3/cms to 10.2.1 or later

composer require "typo3/cms:^10.2.1"

Composer

Update typo3/cms-core to 10.2.1 or later

composer require "typo3/cms-core:^10.2.1"

Composer

Update typo3/cms to 8.7.30 or later

composer require "typo3/cms:^8.7.30"

Composer

Update typo3/cms-core to 8.7.30 or later

composer require "typo3/cms-core:^8.7.30"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 1 ecosystem: packagist (2).

Package	Ecosystem	Affected	Fixed In
typo3/cms	packagist	v9.0.0, v9.1.0, v9.2.0, v9.2.1 (+17 more)	9.5.12
typo3/cms-core	packagist	v9.0.0, v9.1.0, v9.2.0, v9.2.1 (+17 more)	9.5.12
typo3/cms	packagist	v10.0.0, v10.1.0, v10.2.0	10.2.1
typo3/cms-core	packagist	v10.0.0, v10.1.0, v10.2.0	10.2.1
typo3/cms	packagist	8.0.0, 8.0.1, 8.1.0, 8.1.1 (+41 more)	8.7.30
typo3/cms-core	packagist	v8.7.10, v8.7.11, v8.7.12, v8.7.13 (+19 more)	8.7.30

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2019-19849?: TYPO3 Insecure Deserialization in Query Generator & Query View This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2019-19849?: CVE-2019-19849 affects typo3/cms and typo3/cms-core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-19849 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-rcgc-4xfc-564v

Related CVEs

CVE-2022-47406
CRITICAL
TYPO3 vulnerable to Insufficient Session Expiration
CVE-2011-4628
CRITICAL
Typo3 Authentication Bypass
CVE-2021-21355
HIGH
Unrestricted File Upload in Form Framework
CVE-2026-47343
HIGH
TYPO3 CMS: Destructive Actions on File Mount Folders
CVE-2010-1153
HIGH
TYPO3 PHP remote file inclusion vulnerability
CVE-2023-24814
HIGH
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
CVE-2026-0859
MEDIUM
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
CVE-2018-14041
MEDIUM
Bootstrap Cross-site Scripting vulnerability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies