CVE-2022-36108 — Cross-site Scripting in CMS

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
CNA6.5
EPSS
0.7%
top 28.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Typo3 CMSTypo3 Cms-coreTypo3
Timeline
PublishedSep 13
Latest updateSep 16

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶Packagisttypo3/cms10.3.0 — 10.4.32+1
▶Packagisttypo3/cms-core10.3.0 — 10.4.32+1
▶NVDtypo3/typo310.0.0 — 10.4.31+1
▶CVEListV5typo3/typo3>= 10.3.0, < 10.4.32, >= 11.0.0, < 11.5.16+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper↗2022-09-16
▶
GHSA
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper↗2022-09-16
▶
CVEList
Cross-Site Scripting in typo3/cms-core↗2022-09-13
▶
CVE-2022-36108 — Cross-site Scripting in Typo3 CMS | cvebase