CVE-2022-31048CWE-79

Cross-Site Scripting in Form Framework

Medium · published June 14, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00773 · 55.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-14T20:50Z
EPSS history
Timeline
  • 14 JUN 20:50Z
    Cross-Site Scripting in Form Framework
    cvelistv5