Vulnerability Description
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Typo3 | Typo3 | >= 7.0.0, < 7.6.57 |
Related Weaknesses (CWE)
References
- https://github.com/TYPO3/typo3/commit/7447a3d1283017d2ee08737a7972c720001a93e9PatchThird Party Advisory
- https://github.com/TYPO3/typo3/security/advisories/GHSA-8gmv-9hwg-w89gThird Party Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2022-001Vendor Advisory
- https://github.com/TYPO3/typo3/commit/7447a3d1283017d2ee08737a7972c720001a93e9PatchThird Party Advisory
- https://github.com/TYPO3/typo3/security/advisories/GHSA-8gmv-9hwg-w89gThird Party Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2022-001Vendor Advisory
FAQ
What is CVE-2022-31046?
CVE-2022-31046 is a vulnerability with a CVSS score of 4.3 (MEDIUM). TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed ...
How severe is CVE-2022-31046?
CVE-2022-31046 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31046?
Check the references section above for vendor advisories and patch information. Affected products include: Typo3 Typo3.