Lucene search

GitHub Advisory DatabaseGHSA-3R95-23JP-MHVG

HistoryJun 17, 2022 - 8:55 p.m.

Cross-Site Scripting in TYPO3's Form Framework

2022-06-1720:55:48

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

typo3

form framework

update

versions

elts

backend user

vulnerable

exploit

security advisory

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

25.1%

JSON

> ### Meta
> * CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.9)

Problem

It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.

Solution

Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

Credits

Thanks to Gabe Troyan who reported and fixed the issue.

References

TYPO3-CORE-SA-2022-003

Affected configurations

Vulners

Node

typo3typo3_cmsRange11.0.0–11.5.11

typo3typo3_cmsRange10.0.0–10.4.29

typo3cms-coreRange11.0.0–11.5.11

typo3cms-coreRange10.0.0–10.4.29

typo3cms-coreRange9.0.0–9.5.35

typo3cms-coreRange8.0.0–8.7.47

VendorProductVersionCPE
typo3typo3_cms*cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*
typo3cms-core*cpe:2.3:a:typo3:cms-core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3_cms	*	cpe:2.3:a:typo3:typo3_cms::::::::
typo3	cms-core	*	cpe:2.3:a:typo3:cms-core::::::::

References

github.com/advisories/GHSA-3r95-23jp-mhvg

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-31048.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-31048.yaml

github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0

github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg

nvd.nist.gov/vuln/detail/CVE-2022-31048

typo3.org/security/advisory/typo3-core-sa-2022-003

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

25.1%

JSON

Related for GHSA-3R95-23JP-MHVG