CVE-2022-36107 — Cross-site Scripting in CMS

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
CNA6.5
EPSS
0.7%
top 28.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Typo3 CMSTypo3 Cms-coreTypo3
Timeline
PublishedSep 13
Latest updateSep 16

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶Packagisttypo3/cms10.0.0 — 10.4.32+1
▶Packagisttypo3/cms-core7.0.0 — 7.6.58+4
▶NVDtypo3/typo37.0.0 — 7.6.57+4
▶CVEListV5typo3/typo35 versions+4

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController↗2022-09-16
▶
OSV
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController↗2022-09-16
▶
CVEList
Stored Cross-Site Scripting via FileDumpController↗2022-09-13
▶
CVE-2022-36107 — Cross-site Scripting in Typo3 CMS | cvebase