CVE-2022-31046: Information Disclosure via Export Module in TYPO3 CMS
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
Other sources
TYPO3-CORE-SA-2022-001: Information Disclosure via Export Module
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-31046?
CVE-2022-31046 is a vulnerability in TYPO3 that allows authenticated users to export internal details of a database table.
What is the severity of CVE-2022-31046?
The severity of CVE-2022-31046 is medium with a CVSS score of 4.3.
How does CVE-2022-31046 impact TYPO3?
CVE-2022-31046 allows authenticated users to access and export internal details of a database table in TYPO3.
How can I fix CVE-2022-31046?
To fix CVE-2022-31046, update TYPO3 to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, or 11.5.11.
Where can I find more information about CVE-2022-31046?
You can find more information about CVE-2022-31046 in the TYPO3 security advisory TYPO3-CORE-SA-2022-001 and the associated GitHub references.