Vulnerability advisory
CVE-2022-23504
TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
Also known as BIT-typo3-2022-23504GHSA-8w3p-qh3x-6gjr
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| c91b70e450c52d29ffb08115fffbb7832b15a330 to before 8a90081d0135df5df51c49ba0b456fa3d4911720 | 8a90081d0135df5df51c49ba0b456fa3d4911720 |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 7dd798416ced8107d383c4961b1c9b62b438677b | 7dd798416ced8107d383c4961b1c9b62b438677b |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before 819260632d66317021f37c37057dc13914ff1679 | 819260632d66317021f37c37057dc13914ff1679 |
Also listed as affected (64)
| |
Description
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.