CVE-2022-31046
Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table.
Does this matter?
Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own.
Description
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.61% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-319
- Affected
- typo3/typo3
- Source
- security-advisories@github.com
References
- https://github.com/TYPO3/typo3/commit/7447a3d1283017d2ee08737a7972c720001a93e9Patch, Third Party Advisory
- https://github.com/TYPO3/typo3/security/advisories/GHSA-8gmv-9hwg-w89gThird Party Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2022-001Vendor Advisory
- https://github.com/TYPO3/typo3/commit/7447a3d1283017d2ee08737a7972c720001a93e9Patch, Third Party Advisory
- https://github.com/TYPO3/typo3/security/advisories/GHSA-8gmv-9hwg-w89gThird Party Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2022-001Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.