CVE-2022-31048
published 2022-06-14CVE-2022-31048: TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.71%
49.0th percentile
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 10.0.0 < 10.4.29 | 10.4.29 |
| typo3 | cms | >= 11.0.0 < 11.5.11 | 11.5.11 |
| typo3 | cms-core | >= 10.0.0 < 10.4.29 | 10.4.29 |
| typo3 | cms-core | >= 11.0.0 < 11.5.11 | 11.5.11 |
| typo3 | cms-core | >= 8.0.0 < 8.7.47 | 8.7.47 |
| typo3 | cms-core | >= 9.0.0 < 9.5.35 | 9.5.35 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | >= 10.0.0 < 10.4.29 | 10.4.29 |
| typo3 | typo3 | >= 11.0.0 < 11.5.11 | 11.5.11 |
| typo3 | typo3 | >= 8.0.0 < 8.7.47 | 8.7.47 |
| typo3 | typo3 | >= 9.0.0 < 9.5.35 | 9.5.35 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-Site Scripting in TYPO3's Form Framework
osv·2022-06-17
CVE-2022-31048 [MEDIUM] Cross-Site Scripting in TYPO3's Form Framework
Cross-Site Scripting in TYPO3's Form Framework
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9)
### Problem
It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.
### Solution
Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.
### Credits
Thanks to Gabe Troyan who reported and fixed the issue.
### References
* [TYPO3-CORE-SA-2022-003](https://typo3.org/security/advisory/typo3-core-sa-2022-003)
GHSA
Cross-Site Scripting in TYPO3's Form Framework
ghsa·2022-06-17
CVE-2022-31048 [MEDIUM] CWE-79 Cross-Site Scripting in TYPO3's Form Framework
Cross-Site Scripting in TYPO3's Form Framework
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9)
### Problem
It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.
### Solution
Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.
### Credits
Thanks to Gabe Troyan who reported and fixed the issue.
### References
* [TYPO3-CORE-SA-2022-003](https://typo3.org/security/advisory/typo3-core-sa-2022-003)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvghttps://typo3.org/security/advisory/typo3-core-sa-2022-003https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvghttps://typo3.org/security/advisory/typo3-core-sa-2022-003
2022-06-14
Published