-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of user-specific parameters in Doctrine query caching. The advisory explicitly warns against setting parameters inside addFilterConstraint(), as this bypasses proper cache key differentiation. User-specific security constraints (like company affiliation) were not included in the cache key, allowing cached queries from one user to be reused for another. While the core fix involves implementing CacheAwareInterface in global objects, the direct vulnerable pattern occurs in custom SQL filters where parameters are set internally, making addFilterConstraint() the most specific identifiable vulnerable function.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/flow | composer | >= 3.0.0, < 3.0.12 | 3.0.12 |
| typo3/flow | composer | >= 3.1.0, < 3.1.10 | 3.1.10 |
| typo3/flow | composer | >= 3.2.0, < 3.2.13 | 3.2.13 |
| typo3/flow | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
| typo3/flow | composer | >= 4.0.0, < 4.0.6 | 4.0.6 |
KEV Misses 88% of Exploited CVEs- Get the report