// For flags

CVE-2022-36104

Denial of Service via Page Error Handling in TYPO3/cms

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.

TYPO3 es un sistema de administración de contenidos web de código abierto basado en PHP y publicado bajo la licencia GNU GPL. En versiones afectadas, la petición de recursos no válidos o inexistentes por medio de HTTP desencadena el manejador de errores de la página que, de nuevo, podría recuperar el contenido para mostrarlo como un mensaje de error desde otra página. Esto conlleva a un escenario en el que la aplicación es llamado a si mismo de forma recursiva, amplificando el impacto del ataque inicial hasta que son superados los límites del servidor web. Es recomendado a usuarios actualizar a TYPO3 versión 11.5.16 para resolver este problema. No se presentan mitigaciones conocidas para este problema

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-07-15 CVE Reserved
  • 2022-09-13 CVE Published
  • 2024-05-04 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Typo3
Search vendor "Typo3"
 Typo3
Search vendor "Typo3" for product "Typo3"
 >= 11.4.0 <= 11.5.15
Search vendor "Typo3" for product "Typo3" and version " >= 11.4.0 <= 11.5.15"
-
Affected