Vulnerability · Published Jun 14, 2022 · Assigned by GitHub_M

CVE-2022-31049Cross-Site Scripting in Frontend Login Mailer

Medium 5.4

In plain English

A medium-severity cross-site scripting in typo3 from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.8%top 43.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms	10.4.29	GHSA-h4mx-xv96-2jgm
Packagist	typo3/cms	11.5.11	GHSA-h4mx-xv96-2jgm
Packagist	typo3/cms-core	9.5.35	GHSA-h4mx-xv96-2jgm
Packagist	typo3/cms-core	10.4.29	GHSA-h4mx-xv96-2jgm
Packagist	typo3/cms-core	11.5.11	GHSA-h4mx-xv96-2jgm

Affected products (as reported)

Vendor	Product	Versions
TYPO3	typo3	>= 9.0.0, < 9.5.34>= 10.0.0, < 10.4.29>= 11.0.0, < 11.5.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm x_refsource_CONFIRM
https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d x_refsource_MISC
https://typo3.org/security/advisory/typo3-core-sa-2022-004 x_refsource_MISC