CVE-2022-31046 json
Information Disclosure via Export Module in TYPO3 CMS
published 2022-06-14 4 y ago modified 2026-06-17 4 mo ago also BIT-typo3-2022-31046 , EUVD-2022-5995 , GHSA-8gmv-9hwg-w89g
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
Patch / fix
- packagist typo3/cms-core 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
- packagist typo3/cms 10.4.29, 11.5.11
- bitnami typo3 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
- typo3 typo3 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=7.0.0, <7.6.57 >=8.0.0, <8.7.47 >=9.0.0, <9.5.35 >=10.0.0, <10.4.29 >=11.0.0, <11.5.11 |
7.6.57 8.7.47 9.5.35 10.4.29 11.5.11 |
| packagist | typo3/cms | >=10.0.0, <10.4.29 >=11.0.0, <11.5.11 |
10.4.29 11.5.11 |
| bitnami | typo3 | >=7.0.0, <7.6.57 >=8.0.0, <8.7.47 >=9.0.0, <9.5.35 >=10.0.0, <10.4.29 >=11.0.0, <11.5.11 |
7.6.57 8.7.47 9.5.35 10.4.29 11.5.11 |
Affected products
- TYPO3 typo3
Classification
References
-
github.com
/TYPO3/typo3/commit/7447a3d1283017d2ee08737a7972c720001a93e9
web, patch, third-party-advisory
-
typo3.org
/security/advisory/typo3-core-sa-2022-001
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-8gmv-9hwg-w89g
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-31046
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-31046.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-31046.yaml
web
-
github.com
/TYPO3-CMS/core
package
Sources
- CVE List CVE-2022-31046
- GitHub Advisory GHSA-8gmv-9hwg-w89g
- NVD CVE-2022-31046
- OSV BIT-typo3-2022-31046
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.