CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36106 – Missing check for expiration time of password reset token in TYPO3
https://notcve.org/view.php?id=CVE-2022-36106
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. • https://github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a https://github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2 https://typo3.org/security/advisory/typo3-core-sa-2022-008 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-36107 – Stored Cross-Site Scripting via FileDumpController
https://notcve.org/view.php?id=CVE-2022-36107
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. • https://github.com/TYPO3/typo3/commit/bd58d2ff2eeef89e63ef754a2389597d22622a39 https://github.com/TYPO3/typo3/security/advisories/GHSA-9c6w-55cp-5w25 https://typo3.org/security/advisory/typo3-core-sa-2022-009 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36104 – Denial of Service via Page Error Handling in TYPO3/cms
https://notcve.org/view.php?id=CVE-2022-36104
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue. • https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13 https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q https://typo3.org/security/advisory/typo3-core-sa-2022-006 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36108 – Cross-Site Scripting in typo3/cms-core
https://notcve.org/view.php?id=CVE-2022-36108
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. TYPO3 es un sistema de administración de contenidos web de código abierto basado en PHP y publicado bajo la licencia GNU GPL. • https://github.com/TYPO3/typo3/commit/6863f73818c36b0b88c677ba533765c8074907b4 https://github.com/TYPO3/typo3/security/advisories/GHSA-fv2m-9249-qx85 https://typo3.org/security/advisory/typo3-core-sa-2022-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31050 – Insufficient Session Expiration in TYPO3 Admin Tool
https://notcve.org/view.php?id=CVE-2022-31050
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq https://typo3.org/security/advisory/typo3-core-sa-2022-005 • CWE-613: Insufficient Session Expiration •