CVE-2022-31048

TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

CVSS v3.0 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://typo3.org/security/advisory/typo3-core-sa-2022-003	Vendor Advisory
https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg	Third Party Advisory
https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0	Patch Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:typo3:typo3::::::::
	cpe:2.3:a:typo3:typo3::::::::
	cpe:2.3:a:typo3:typo3:::::elts:::*
	cpe:2.3:a:typo3:typo3:::::elts:::*

Information

Published : 2022-06-14 14:15

Updated : 2022-06-23 06:16

NVD link : CVE-2022-31048

Mitre link : CVE-2022-31048

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

typo3

typo3

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-003", "name": "https://typo3.org/security/advisory/typo3-core-sa-2022-003", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg", "name": "https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0", "name": "https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-31048", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}}, "publishedDate": "2022-06-14T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "11.5.11", "versionStartIncluding": "11.0.0"}, {"cpe23Uri": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "10.4.29", "versionStartIncluding": "10.0.0"}, {"cpe23Uri": "cpe:2.3:a:typo3:typo3:*:*:*:*:elts:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "8.7.47", "versionStartIncluding": "8.0.0"}, {"cpe23Uri": "cpe:2.3:a:typo3:typo3:*:*:*:*:elts:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.5.35", "versionStartIncluding": "9.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-06-23T13:16Z"}