CVE-2022-31046: Information Disclosure via Export Module in TYPO3 CMS
First published: Tue Jun 14 2022(Updated: )
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms-core | >=10.0.0<10.4.29>=11.0.0<11.5.11 | |
| composer/typo3/cms | >=10.0.0<10.4.29>=11.0.0<11.5.11 | |
| Typo3 Typo3 | >=7.0.0<7.6.57 | |
| Typo3 Typo3 | >=8.0.0<8.7.47 | |
| Typo3 Typo3 | >=9.0.0<9.5.35 | |
| Typo3 Typo3 | >=10.0.0<10.4.29 | |
| Typo3 Typo3 | >=11.0.0<11.5.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-31046?
CVE-2022-31046 is a vulnerability in TYPO3 that allows authenticated users to export internal details of a database table.
What is the severity of CVE-2022-31046?
The severity of CVE-2022-31046 is medium with a CVSS score of 4.3.
How does CVE-2022-31046 impact TYPO3?
CVE-2022-31046 allows authenticated users to access and export internal details of a database table in TYPO3.
How can I fix CVE-2022-31046?
To fix CVE-2022-31046, update TYPO3 to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, or 11.5.11.
Where can I find more information about CVE-2022-31046?
You can find more information about CVE-2022-31046 in the TYPO3 security advisory TYPO3-CORE-SA-2022-001 and the associated GitHub references.
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/title
- agent/description
- agent/event
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/7.0.0
- version/typo3 typo3/8.0.0
- version/typo3 typo3/9.0.0
- version/typo3 typo3/10.0.0
- version/typo3 typo3/11.0.0