Cross-Site Scripting in TYPO3's Form Framework

TRUNG BÌNH 5.4CVE-2022-31048 · BIT-typo3-2022-31048 · GHSA-3r95-23jp-mhvg · Công bố 14/06/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-31048 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng typo3/cms, typo3/cms-core, typo3 (typo3).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.77%, cao hơn 55.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 10.4.29, 11.5.11, 8.7.47, 9.5.35 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
typo3/cms Packagist	`≥ 10.0.0, < 10.4.29≥ 11.0.0, < 11.5.11`	`10.4.2911.5.11`
typo3/cms-core Packagist	`≥ 10.0.0, < 10.4.29≥ 11.0.0, < 11.5.11≥ 8.0.0, < 8.7.47≥ 9.0.0, < 9.5.35`	`10.4.2911.5.118.7.479.5.35`
typo3 typo3	`≥ 10.0.0, < 10.4.29≥ 11.0.0, < 11.5.11≥ 8.0.0, < 8.7.47≥ 9.0.0, < 9.5.35`	`10.4.2911.5.118.7.479.5.35`

Mô tả

Meta

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.9)

Problem

It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.

Solution

Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

Credits

Thanks to Gabe Troyan who reported and fixed the issue.

References

TYPO3-CORE-SA-2022-003

Mô tả của NVD

TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.