PT-2022-23194 · Typo3 · Typo3

Rik Willems · Published 2022-09-13 · Updated 2024-03-06 · CVE-2022-36104

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.16

Description The issue arises when requesting invalid or non-existing resources via HTTP, triggering the page error handler to retrieve content from another page, leading to recursive application calls that amplify the initial attack's impact until the web server's limits are exceeded.

Recommendations Update to TYPO3 version 11.5.16 to resolve this issue. As a temporary workaround, consider restricting access to invalid or non-existing resources via HTTP to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-TYPO3-2022-36104

CVE-2022-36104

GHSA-FFFR-7X4X-F98Q

Affected Products

Typo3

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36104.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36104.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36104.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13 · Patch
• https://osv.dev/vulnerability/BIT-typo3-2022-36104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36104 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2022-006 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36104 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fffr-7x4x-f98q · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/fc51ccbf2bb8a8c959aa74cbceca124971e6e7fd · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q · Note
• https://t.me/cvenotify/36330 · Telegram Post