PT-2022-21714 · Typo3 · Typo3

Chris Müller · Published 2022-06-17 · Updated 2022-07-19 · CVE-2022-33154

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 schema extension versions prior to 1.13.1 TYPO3 schema extension versions 2.x prior to 2.5.1

Description The issue allows for XSS due to the failure to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit this issue.

Recommendations For versions prior to 1.13.1, update to version 1.13.1 or later. For versions 2.x prior to 2.5.1, update to version 2.5.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-33154

GHSA-374W-GWQR-FMXG

Affected Products

Typo3

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/brotkrueml/schema/CVE-2022-33154.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-33154 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2022-012 · Patch
• https://osv.dev/vulnerability/CVE-2022-33154 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-374w-gwqr-fmxg · Vendor Advisory
• https://github.com/brotkrueml/schema · Note
• https://t.me/cibsecurity/46124 · Telegram Post