CVE-2022-31046
Description
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
How to fix
- typo3 typo37.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11 or later
- typo3/cms-core7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11 or later
- typo3/cms10.4.29, 11.5.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 typo3 | 7.0.0 ≤ v < 7.6.57, 8.0.0 ≤ v < 8.7.47, 9.0.0 ≤ v < 9.5.35, 10.0.0 ≤ v < 10.4.29, 11.0.0 ≤ v < 11.5.11 | 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11 |
| typo3/cms-corePackagist | 7.0.0 ≤ v < 7.6.57, 8.0.0 ≤ v < 8.7.47, 9.0.0 ≤ v < 9.5.35, 10.0.0 ≤ v < 10.4.29, 11.0.0 ≤ v < 11.5.11 | 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11 |
| typo3/cmsPackagist | 10.0.0 ≤ v < 10.4.29, 11.0.0 ≤ v < 11.5.11 | 10.4.29, 11.5.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.