CVE-2022-23504
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
Summary
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TYPO3 | typo3 | >= 9.0.0, < 9.5.38 | affected |
| TYPO3 | typo3 | >= 10.0.0, < 10.4.33 | affected |
| TYPO3 | typo3 | >= 11.0.0, < 11.5.20 | affected |
| TYPO3 | typo3 | >= 12.0.0, < 12.1.1 | affected |
Weaknesses
- CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-917: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.