QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-23504

Back to search

CVE-2022-23504

Published: Dec 14, 2022

Modified: Apr 21, 2025

PUBLISHED

CVSS v3.1

5.7

MEDIUM

Description

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

VendorProductVersions

TYPO3

typo3

affected
>= 9.0.0, < 9.5.38
affected
>= 10.0.0, < 10.4.33
affected
>= 11.0.0, < 11.5.20
affected
>= 12.0.0, < 12.1.1

Weaknesses (CWE)

CWE-200
CWE-917

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now