Vulnerability advisory

CVE-2022-31046

Information Disclosure via Export Module in TYPO3 CMS

Published Jun 14, 2022Updated Oct 28, 2026OSV record ↗

Also known as BIT-typo3-2022-31046GHSA-8gmv-9hwg-w89g

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
c91b70e450c52d29ffb08115fffbb7832b15a330 to before e87db3fd3ffbc41e2fc848d5295962d8c6d6d2d1	`e87db3fd3ffbc41e2fc848d5295962d8c6d6d2d1`
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 7396e8fe588a8690293d79318e7048bfb11ad8ca	`7396e8fe588a8690293d79318e7048bfb11ad8ca`
Not specified	`7447a3d1283017d2ee08737a7972c720001a93e9`
Also listed as affected (49) `v11.5.10` `v10.4.28` `v11.5.9` `v10.4.27` `v11.5.8` `v10.4.26` `v11.5.7` `v10.4.25` `v10.4.24` `v11.5.6` `v11.5.5` `v10.4.23` `v10.4.22` `v11.5.4` `v11.5.3` `v11.5.2` `v11.5.1` `v11.5.0` `v10.4.21` `v11.4.0` `v10.4.20` `v10.4.19` `v10.4.18` `v11.3.0` `v10.4.17` `v10.4.16` `v11.2.0` `v10.4.15` `v10.4.14` `v11.1.0` `v10.4.13` `v11.0.0` `v10.4.12` `v10.4.11` `v10.4.10` `v10.4.9` `v10.4.8` `v10.4.7` `v10.4.6` `v10.4.5` `v10.4.4` `v10.4.3` `v10.4.2` `v10.4.1` `v10.4.0` `v10.3.0` `v10.2.0` `v10.1.0` `v10.0.0`

Description

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.

CVE-2022-31046

Affected versions

Repository

Description

References