CVE-2022-23501: TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to…

PriorityP338medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.48%

37.7th percentile

TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
typo3	cms	>= 10.0.0 < 10.4.33	10.4.33
typo3	cms	>= 11.0.0 < 11.5.20	11.5.20
typo3	cms	>= 12.0.0 < 12.1.1	12.1.1
typo3	cms-core	>= 0 < 8.7.49	8.7.49
typo3	cms-core	>= 10.0.0 < 10.4.33	10.4.33
typo3	cms-core	>= 11.0.0 < 11.5.20	11.5.20
typo3	cms-core	>= 12.0.0 < 12.1.1	12.1.1
typo3	cms-core	>= 9.0.0 < 9.5.38	9.5.38
typo3	typo3	< 8.7.49	8.7.49
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	>= 10.0.0 < 10.4.33	10.4.33
typo3	typo3	>= 11.0.0 < 11.5.20	11.5.20
typo3	typo3	>= 12.0.0 < 12.1.1	12.1.1
typo3	typo3	>= 9.0.0 < 9.5.38	9.5.38

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.