CVE-2022-31047: Insertion of Sensitive Information into Log File in typo3/cms-core
> ### Meta > CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C (4.9)
Problem It has been discovered that system internal credentials or keys (e.g. database credentials) have been logged as plaintext in exception handlers, when logging the complete exception stack trace.
Solution Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.
Credits Thanks to Marco Huber who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue.
References TYPO3-CORE-SA-2022-002
Other sources
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.
TYPO3-CORE-SA-2022-002: Information Disclosure via Exception Handling/Logger
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31047?
The severity of CVE-2022-31047 is medium with a CVSS score of 6.5.
How does CVE-2022-31047 impact TYPO3?
CVE-2022-31047 can lead to information disclosure through the logging of system internal credentials or keys.
Which versions of TYPO3 are affected by CVE-2022-31047?
TYPO3 versions 7.0.0 to 7.6.57, 8.0.0 to 8.7.47, 9.0.0 to 9.5.35, 10.0.0 to 10.4.29, and 11.0.0 to 11.5.11 are affected by CVE-2022-31047.
How can I fix CVE-2022-31047?
To fix CVE-2022-31047, upgrade to TYPO3 version 7.6.58, 8.7.48, 9.5.36, 10.4.30, or 11.5.12.
Where can I find more information about CVE-2022-31047?
You can find more information about CVE-2022-31047 in the TYPO3 security advisory TYPO3-CORE-SA-2022-002.