PT-2022-21716 · Typo3 · Wp-Matomo Integration

Chris Müller · Published 2022-06-17 · Updated 2024-03-06 · CVE-2022-33156

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions matomo integration extension versions prior to 1.3.2

Description The issue allows for XSS due to the extension's failure to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit this issue.

Recommendations For matomo integration extension versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the extension to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MATOMO-2022-33156

CVE-2022-33156

GHSA-GVXV-P9RV-GMCG

Affected Products

Wp-Matomo Integration

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/brotkrueml/typo3-matomo-integration/CVE-2022-33156.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2022-33156 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-ext-sa-2022-011 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-matomo-2022-33156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33156 · Security Note
• https://osv.dev/vulnerability/GHSA-gvxv-p9rv-gmcg · Vendor Advisory
• https://github.com/brotkrueml/typo3-matomo-integration · Note
• https://t.me/cvenotify/32977 · Telegram Post