What is TYPO3-CORE-SA-2022-004?

TYPO3-CORE-SA-2022-004 is a vulnerability in TYPO3, an open source web content management system, that allows for cross-site scripting (XSS) attacks in the frontend login mailer.

What is the severity of TYPO3-CORE-SA-2022-004?

The severity of TYPO3-CORE-SA-2022-004 is medium with a score of 5.4.

Which versions of TYPO3 are affected by TYPO3-CORE-SA-2022-004?

TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 are affected by TYPO3-CORE-SA-2022-004.

How can I fix TYPO3-CORE-SA-2022-004?

To fix TYPO3-CORE-SA-2022-004, upgrade to TYPO3 versions 9.5.35 ELTS, 10.4.30, or 11.5.12.

Where can I find more information about TYPO3-CORE-SA-2022-004?

You can find more information about TYPO3-CORE-SA-2022-004 in the TYPO3 security advisory TYPO3-CORE-SA-2022-004.

Vulnerability/
CVE-2022-31049

medium

5.4

CWE

14/6/2022

3/8/2024

CVE-2022-31049: Cross-Site Scripting in Frontend Login Mailer

First published: Tue Jun 14 2022(Updated: )

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
composer/typo3/cms-core	>=10.0.0<10.4.29>=11.0.0<11.5.11
composer/typo3/cms	>=10.0.0<10.4.29>=11.0.0<11.5.11
Typo3 Typo3	>=9.0.0<9.5.35
Typo3 Typo3	>=10.0.0<10.4.29
Typo3 Typo3	>=11.0.0<11.5.11

Remedy

https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is TYPO3-CORE-SA-2022-004?
TYPO3-CORE-SA-2022-004 is a vulnerability in TYPO3, an open source web content management system, that allows for cross-site scripting (XSS) attacks in the frontend login mailer.
What is the severity of TYPO3-CORE-SA-2022-004?
The severity of TYPO3-CORE-SA-2022-004 is medium with a score of 5.4.
Which versions of TYPO3 are affected by TYPO3-CORE-SA-2022-004?
TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 are affected by TYPO3-CORE-SA-2022-004.
How can I fix TYPO3-CORE-SA-2022-004?
To fix TYPO3-CORE-SA-2022-004, upgrade to TYPO3 versions 9.5.35 ELTS, 10.4.30, or 11.5.12.
Where can I find more information about TYPO3-CORE-SA-2022-004?
You can find more information about TYPO3-CORE-SA-2022-004 in the TYPO3 security advisory TYPO3-CORE-SA-2022-004.

collector/friends-of-php
collector/nvd-index
agent/type
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/remedy
agent/references
agent/author
agent/weakness
agent/severity
agent/last-modified-date
agent/tags
agent/title
agent/description
agent/event
package-manager/composer
vendor/typo3
canonical/typo3 typo3
version/typo3 typo3/9.0.0
version/typo3 typo3/10.0.0
version/typo3 typo3/11.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.