CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-36105 – User Enumeration via Response Timing in TYPO3
https://notcve.org/view.php?id=CVE-2022-36105
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. • https://github.com/TYPO3/typo3/commit/f8b83ce15d4ea275a5a5e564e5d324242f7937b6 https://github.com/TYPO3/typo3/security/advisories/GHSA-m392-235j-9r7r https://typo3.org/security/advisory/typo3-core-sa-2022-007 • CWE-203: Observable Discrepancy •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-36107 – Stored Cross-Site Scripting via FileDumpController
https://notcve.org/view.php?id=CVE-2022-36107
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. • https://github.com/TYPO3/typo3/commit/bd58d2ff2eeef89e63ef754a2389597d22622a39 https://github.com/TYPO3/typo3/security/advisories/GHSA-9c6w-55cp-5w25 https://typo3.org/security/advisory/typo3-core-sa-2022-009 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31050 – Insufficient Session Expiration in TYPO3 Admin Tool
https://notcve.org/view.php?id=CVE-2022-31050
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq https://typo3.org/security/advisory/typo3-core-sa-2022-005 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-31048 – Cross-Site Scripting in Form Framework
https://notcve.org/view.php?id=CVE-2022-31048
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0 https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg https://typo3.org/security/advisory/typo3-core-sa-2022-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31049 – Cross-Site Scripting in Frontend Login Mailer
https://notcve.org/view.php?id=CVE-2022-31049
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm https://typo3.org/security/advisory/typo3-core-sa-2022-004 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •