CVE-2022-36108 json
Cross-Site Scripting in typo3/cms-core
published 2022-09-13 4 y ago modified 2026-06-17 4 mo ago also BIT-typo3-2022-36108 , EUVD-2022-6809 , GHSA-fv2m-9249-qx85
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
Patch / fix
- packagist typo3/cms-core 10.4.32, 11.5.16
- packagist typo3/cms 10.4.32, 11.5.16
- bitnami typo3 10.4.31, 11.5.15
- github.com/TYPO3/typo3@6863f73 commit
- github.com/TYPO3/typo3@c62e16f commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=10.3.0, <10.4.32 >=11.0.0, <11.5.16 |
10.4.32 11.5.16 |
| packagist | typo3/cms | >=10.3.0, <10.4.32 >=11.0.0, <11.5.16 |
10.4.32 11.5.16 |
| bitnami | typo3 | >=10.0.0, <10.4.31 >=11.0.0, <11.5.15 |
10.4.31 11.5.15 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/TYPO3/typo3/commit/6863f73818c36b0b88c677ba533765c8074907b4
web, patch, third-party-advisory
-
github.com
/TYPO3/typo3/commit/c62e16fac031c270d9759c7261e504c7e25405df
web
-
typo3.org
/security/advisory/typo3-core-sa-2022-010
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-fv2m-9249-qx85
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36108
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36108.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36108.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2022-36108
- GitHub Advisory GHSA-fv2m-9249-qx85
- NVD CVE-2022-36108
- OSV BIT-typo3-2022-36108
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.