CVE-2022-36107

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-36107
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36107.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36107
Aliases
Published
2022-09-13T17:30:13Z
Modified
2025-10-14T19:13:14.613708Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
Stored Cross-Site Scripting via FileDumpController
Details

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the FileDumpController (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

References

Affected packages

Git / github.com/TYPO3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/TYPO3/typo3
Events
Introduced
c91b70e450c52d29ffb08115fffbb7832b15a330
Fixed
1a3a7c13e830700f43bd7425ffb8302a3d4c7056
Type
GIT
Repo
https://github.com/TYPO3/typo3
Events
Introduced
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234
Fixed
bb2cf378b62703708a1d3d0ac84809db1831a839

Affected versions

v10.*

v10.0.0
v10.1.0
v10.2.0
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9

v11.*

v11.0.0
v11.1.0
v11.2.0
v11.3.0
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.2
v11.5.3
v11.5.4
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9

Database specific 

{
    "unresolved_versions": [
        {
            "type": "",
            "events": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.6.58"
                }
            ]
        },
        {
            "type": "",
            "events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.7.48"
                }
            ]
        },
        {
            "type": "",
            "events": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.5.37"
                }
            ]
        }
    ]
}