CVE-2022-31049

Published: Jun 14, 2022Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

Affected (3)

Products: Typo3: Typo3

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Typo3 Typo3	From 10.0.0 to 10.4.29
Typo3 Typo3	From 11.0.0 to 11.5.11
Typo3 Typo3	From 9.0.0 to 9.5.35

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm

Source: security-advisories@github.com

Third Party Advisory

https://typo3.org/security/advisory/typo3-core-sa-2022-004

Source: security-advisories@github.com

Vendor Advisory

https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://typo3.org/security/advisory/typo3-core-sa-2022-004

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.