8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
34.8%
Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code.
The existence of individual TypoScript instructions for a particular form item (known as formDefinitionOverrides
) and a valid backend user account with access to the form module are needed to exploit this vulnerability.
Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-23503.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23503.yaml
github.com/TYPO3/typo3
github.com/TYPO3/typo3/commit/1302e88565821f2159e08b5d818d28de17ecc830
github.com/TYPO3/typo3/security/advisories/GHSA-c5wx-6c2c-f7rm
nvd.nist.gov/vuln/detail/CVE-2022-23503
typo3.org/security/advisory/typo3-core-sa-2022-015