Vulnerability · Published Jun 14, 2022 · Assigned by GitHub_M

CVE-2022-31048Cross-Site Scripting in Form Framework

Medium 5.4

In plain English

A medium-severity cross-site scripting in typo3 from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.8%top 43.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms	10.4.29	GHSA-3r95-23jp-mhvg
Packagist	typo3/cms	11.5.11	GHSA-3r95-23jp-mhvg
Packagist	typo3/cms-core	8.7.47	GHSA-3r95-23jp-mhvg
Packagist	typo3/cms-core	9.5.35	GHSA-3r95-23jp-mhvg
Packagist	typo3/cms-core	10.4.29	GHSA-3r95-23jp-mhvg
Packagist	typo3/cms-core	11.5.11	GHSA-3r95-23jp-mhvg

Affected products (as reported)

Vendor	Product	Versions
TYPO3	typo3	>= 8.0.0, < 8.7.47>= 9.0.0, < 9.5.34>= 10.0.0, < 10.4.29>= 11.0.0, < 11.5.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg x_refsource_CONFIRM
https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0 x_refsource_MISC
https://typo3.org/security/advisory/typo3-core-sa-2022-003 x_refsource_MISC