CVE-2022-23504: TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information…

PriorityP425medium4.9CVSS 3.1

AVNACLPRHUINSUCHINAN

EPSS

0.51%

39.8th percentile

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
typo3	cms	>= 10.0.0 < 10.4.33	10.4.33
typo3	cms	>= 11.0.0 < 11.5.20	11.5.20
typo3	cms	>= 12.0.0 < 12.1.1	12.1.1
typo3	cms-core	>= 10.0.0 < 10.4.33	10.4.33
typo3	cms-core	>= 11.0.0 < 11.5.20	11.5.20
typo3	cms-core	>= 12.0.0 < 12.1.1	12.1.1
typo3	cms-core	>= 9.0.0 < 9.5.38	9.5.38
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	—	—
typo3	typo3	>= 10.0.0 < 10.4.33	10.4.33
typo3	typo3	>= 11.0.0 < 11.5.20	11.5.20
typo3	typo3	>= 12.0.0 < 12.1.1	12.1.1
typo3	typo3	>= 9.0.0 < 9.5.38	9.5.38

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.