PT-2022-20487 · Typo3 · Typo3

Christian Seifert · Published 2022-06-14 · Updated 2024-03-06 · CVE-2022-31049

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 9.5.34 ELTS TYPO3 versions prior to 10.4.29 TYPO3 versions prior to 11.5.11

Description The issue concerns user-submitted content not being properly encoded in HTML emails sent to users. The affected components are mail clients used to view those messages.

Recommendations For versions prior to 9.5.34 ELTS, update to version 9.5.34 ELTS or later. For versions prior to 10.4.29, update to version 10.4.29 or later. For versions prior to 11.5.11, update to version 11.5.11 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-TYPO3-2022-31049

CVE-2022-31049

GHSA-H4MX-XV96-2JGM

Affected Products

Typo3

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31049.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-31049.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-31049.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31049 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2022-004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31049 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h4mx-xv96-2jgm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2022-31049 · Vendor Advisory
• https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm · Note
• https://github.com/TYPO3-CMS/core · Note
• https://t.me/cibsecurity/44463 · Telegram Post