CVE-2022-35628: SQL Injection

Q: What is the severity of CVE-2022-35628?

CVE-2022-35628 is classified as a high severity SQL injection vulnerability that can lead to unauthorized access to the database.

Q: How do I fix CVE-2022-35628?

To fix CVE-2022-35628, upgrade the 'lux' extension to version 17.6.1 or higher, or version 24.0.2 or higher.

Q: Which versions are affected by CVE-2022-35628?

CVE-2022-35628 affects 'lux' extension versions prior to 17.6.1 and between 18.0.0 and 24.0.1.

Q: What is the impact of CVE-2022-35628?

The impact of CVE-2022-35628 includes potential data leakage and unauthorized manipulation of the TYPO3 database.

Q: Was CVE-2022-35628 publicly disclosed?

Yes, CVE-2022-35628 was publicly disclosed as part of TYPO3 security advisory TYPO3-EXT-SA-2022-014.

Published Jun 14, 2022

Updated

A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.

Other sources

TYPO3-EXT-SA-2022-014: SQL Injection in extension "LUX - TYPO3 Marketing Automation" (lux)

Affected Software

3 affected components

composer/in2code/lux>=18.0.0, <24.0.2, <17.6.1

In2code Living User Experience Typo3<17.6.1

In2code Living User Experience Typo3>=18.0.0<24.0.2

Remediation

Patch Available

https://typo3.org/security/advisory/typo3-ext-sa-2022-014

Event History

Jun 14, 2022

Advisory Published

10:59 AM

Jul 12, 2022

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

Description

Frequently Asked Questions

What is the severity of CVE-2022-35628?

CVE-2022-35628 is classified as a high severity SQL injection vulnerability that can lead to unauthorized access to the database.

How do I fix CVE-2022-35628?

To fix CVE-2022-35628, upgrade the 'lux' extension to version 17.6.1 or higher, or version 24.0.2 or higher.

Which versions are affected by CVE-2022-35628?