CVE-2022-36104 json
Denial of Service via Page Error Handling in TYPO3/cms
published 2022-09-13 4 y ago modified 2026-06-17 4 mo ago also BIT-typo3-2022-36104 , EUVD-2022-6793 , GHSA-fffr-7x4x-f98q
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
Patch / fix
- packagist typo3/cms-core 11.5.16
- packagist typo3/cms 11.5.16
- bitnami typo3 11.5.15
- github.com/TYPO3/typo3@179dd7c commit
- github.com/TYPO3/typo3@fc51ccb commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=11.4.0, <11.5.16 |
11.5.16 |
| packagist | typo3/cms | >=11.4.0, <11.5.16 |
11.5.16 |
| bitnami | typo3 | >=11.4.0, <11.5.15 |
11.5.15 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13
web, patch, third-party-advisory
-
github.com
/TYPO3/typo3/commit/fc51ccbf2bb8a8c959aa74cbceca124971e6e7fd
web
-
typo3.org
/security/advisory/typo3-core-sa-2022-006
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36104
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36104.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36104.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2022-36104
- GitHub Advisory GHSA-fffr-7x4x-f98q
- NVD CVE-2022-36104
- OSV BIT-typo3-2022-36104
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.