CVE-2022-31049: Cross-Site Scripting in Frontend Login Mailer
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Other sources
TYPO3-CORE-SA-2022-004: Cross-Site Scripting in Frontend Login Mailer
Affected Software
Remediation
Event History
Frequently Asked Questions
What is TYPO3-CORE-SA-2022-004?
TYPO3-CORE-SA-2022-004 is a vulnerability in TYPO3, an open source web content management system, that allows for cross-site scripting (XSS) attacks in the frontend login mailer.
What is the severity of TYPO3-CORE-SA-2022-004?
The severity of TYPO3-CORE-SA-2022-004 is medium with a score of 5.4.
Which versions of TYPO3 are affected by TYPO3-CORE-SA-2022-004?
TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 are affected by TYPO3-CORE-SA-2022-004.
How can I fix TYPO3-CORE-SA-2022-004?
To fix TYPO3-CORE-SA-2022-004, upgrade to TYPO3 versions 9.5.35 ELTS, 10.4.30, or 11.5.12.
Where can I find more information about TYPO3-CORE-SA-2022-004?
You can find more information about TYPO3-CORE-SA-2022-004 in the TYPO3 security advisory TYPO3-CORE-SA-2022-004.