CVE-2022-31048: Cross-Site Scripting in Form Framework
First published: Tue Jun 14 2022(Updated: )
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms-core | >=10.0.0<10.4.29>=11.0.0<11.5.11 | |
| composer/typo3/cms | >=10.0.0<10.4.29>=11.0.0<11.5.11 | |
| Typo3 Typo3 | >=8.0.0<8.7.47 | |
| Typo3 Typo3 | >=9.0.0<9.5.35 | |
| Typo3 Typo3 | >=10.0.0<10.4.29 | |
| Typo3 Typo3 | >=11.0.0<11.5.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-31048.
What is the title of the vulnerability?
The title of the vulnerability is TYPO3-CORE-SA-2022-003: Cross-Site Scripting in Form Framework.
What is the severity of the vulnerability?
The severity of the vulnerability is medium with a CVSS score of 5.4.
What is affected software by this vulnerability?
The affected software versions are TYPO3 versions: 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11.
How can this vulnerability be exploited?
A valid backend user account with access to the form module is needed to exploit this vulnerability.
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/title
- agent/description
- agent/event
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/8.0.0
- version/typo3 typo3/9.0.0
- version/typo3 typo3/10.0.0
- version/typo3 typo3/11.0.0