CVE-2022-36107CWE-79

Stored Cross-Site Scripting via FileDumpController

Medium · published September 13, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
60.3
In the wild
Unconfirmed
What it is

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00932 · 60.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-09-13T17:30Z
EPSS history
Timeline
  • 13 SEP 17:30Z
    Stored Cross-Site Scripting via FileDumpController
    cvelistv5