CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36104 – Denial of Service via Page Error Handling in TYPO3/cms
https://notcve.org/view.php?id=CVE-2022-36104
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue. • https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13 https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q https://typo3.org/security/advisory/typo3-core-sa-2022-006 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36108 – Cross-Site Scripting in typo3/cms-core
https://notcve.org/view.php?id=CVE-2022-36108
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. TYPO3 es un sistema de administración de contenidos web de código abierto basado en PHP y publicado bajo la licencia GNU GPL. • https://github.com/TYPO3/typo3/commit/6863f73818c36b0b88c677ba533765c8074907b4 https://github.com/TYPO3/typo3/security/advisories/GHSA-fv2m-9249-qx85 https://typo3.org/security/advisory/typo3-core-sa-2022-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36020 – Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer
https://notcve.org/view.php?id=CVE-2022-36020
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. • https://github.com/TYPO3/html-sanitizer/commit/60bfdc7f9b394d0236e16ee4cea8372a7defa493 https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-47m6-46mj-p235 https://packagist.org/packages/masterminds/html5 https://packagist.org/packages/typo3/html-sanitizer • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31050 – Insufficient Session Expiration in TYPO3 Admin Tool
https://notcve.org/view.php?id=CVE-2022-31050
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq https://typo3.org/security/advisory/typo3-core-sa-2022-005 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-31048 – Cross-Site Scripting in Form Framework
https://notcve.org/view.php?id=CVE-2022-31048
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0 https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg https://typo3.org/security/advisory/typo3-core-sa-2022-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •