Vulnerability advisory
CVE-2022-23503
TYPO3 vulnerable to Arbitrary Code Execution via Form Framework
Also known as BIT-typo3-2022-23503GHSA-c5wx-6c2c-f7rm
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| c91b70e450c52d29ffb08115fffbb7832b15a330 to before 8a90081d0135df5df51c49ba0b456fa3d4911720 | 8a90081d0135df5df51c49ba0b456fa3d4911720 |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 7dd798416ced8107d383c4961b1c9b62b438677b | 7dd798416ced8107d383c4961b1c9b62b438677b |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before 819260632d66317021f37c37057dc13914ff1679 | 819260632d66317021f37c37057dc13914ff1679 |
Also listed as affected (64)
| |
Description
TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.