CVE-2022-23504 — Sensitive Information Exposure in Typo3

CWE-200 — Sensitive Information ExposureCWE-917 — Expression Language Injection4 documents4 sources
Severity
4.9MEDIUMNVD
CNA5.7
EPSS
0.3%
top 45.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Typo3Typo3 CMSTypo3 Cms-core
Timeline
PublishedDec 14

Description

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages4 packages

▶Packagisttypo3/cms10.0.0 — 10.4.33+2
▶NVDtypo3/typo39.0.0 — 9.5.38+3
▶Packagisttypo3/cms-core9.0.0 — 9.5.38+3
▶CVEListV5typo3/typo34 versions+3

🔴Vulnerability Details

3
CVEList
TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration↗2022-12-14
▶
GHSA
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration↗2022-12-13
▶
OSV
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration↗2022-12-13
▶
CVE-2022-23504 — Sensitive Information Exposure | cvebase