CVE-2022-36108CWE-79

Cross-Site Scripting in typo3/cms-core

Medium · published September 13, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00930 · 60.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-09-13T17:20Z
EPSS history
Timeline
  • 13 SEP 17:20Z
    Cross-Site Scripting in typo3/cms-core
    cvelistv5