GitHub Advisoryadvisory · Packagist

GHSA-3r95-23jp-mhvg Cross-Site Scripting in TYPO3's Form Framework

MEDIUM Published 2022-06-17 Modified 2022-06-24 Official page ↗
Aliases
CVE-2022-31048
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-06-17

Affected packages

• Packagist typo3/cms-core: >= 8.0.0, < 8.7.47 → fixed in 8.7.47 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.35 → fixed in 9.5.35 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.29 → fixed in 10.4.29 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.11 → fixed in 11.5.11 • Packagist typo3/cms: >= 10.0.0, < 10.4.29 → fixed in 10.4.29 • Packagist typo3/cms: >= 11.0.0, < 11.5.11 → fixed in 11.5.11

Description

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9) Problem It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. Credits Thanks to Gabe Troyan who reported and fixed the issue. References • TYPO3-CORE-SA-2022-003

Related

Alias · CVE (1)

  • CVE-2022-31048 TYPO3 is an open source web content management system. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References