CVEvulnerability

CVE-2022-23504

4.9 MEDIUM Published 2022-12-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-917

Description

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

Affected configurations

• typo3 typo3 (>= 9.0.0 < 9.5.38) • typo3 typo3 (>= 10.0.0 < 10.4.33) • typo3 typo3 (>= 11.0.0 < 11.5.20) • typo3 typo3 (>= 12.0.0 < 12.1.1)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References