Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-23504

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

Published

2022-12-14T08:15:10.830

Last Modified

2024-11-21T06:48:42.130

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.7 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-200
    CWE-917
  • Type: Primary
    CWE-917
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application typo3 typo3 < 9.5.38 Yes
Application typo3 typo3 < 10.4.33 Yes
Application typo3 typo3 < 11.5.20 Yes
Application typo3 typo3 < 12.1.1 Yes
References