CVE-2022-31047 — Log File Information Exposure in Typo3

CWE-532 — Log File Information ExposureCWE-209 — Information Exposure via Error Message4 documents4 sources
Severity
6.5MEDIUMNVD
CNA5.3
EPSS
0.4%
top 39.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Typo3Typo3 CMSTypo3 Cms-core
Timeline
PublishedJun 14
Latest updateJun 17

Description

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Packagisttypo3/cms10.0.0 — 10.4.29+1
▶NVDtypo3/typo37.0.0 — 7.6.57+4
▶Packagisttypo3/cms-core7.0.0 — 7.6.57+4
▶CVEListV5typo3/typo35 versions+4

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Insertion of Sensitive Information into Log File in typo3/cms-core↗2022-06-17
▶
GHSA
Insertion of Sensitive Information into Log File in typo3/cms-core↗2022-06-17
▶
CVEList
Insertion of Sensitive Information into Log File in typo3/cms-core↗2022-06-14
▶
CVE-2022-31047 — Log File Information Exposure in Typo3 | cvebase