CVE-2022-31049

{"containers": {"cna": {"affected": [{"product": "typo3", "vendor": "TYPO3", "versions": [{"status": "affected", "version": ">= 9.0.0, < 9.5.34"}, {"status": "affected", "version": ">= 10.0.0, < 10.4.29"}, {"status": "affected", "version": ">= 11.0.0, < 11.5.11"}]}], "descriptions": [{"lang": "en", "value": "TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-14T20:50:12.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d"}, {"tags": ["x_refsource_MISC"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004"}], "source": {"advisory": "GHSA-h4mx-xv96-2jgm", "discovery": "UNKNOWN"}, "title": "Cross-Site Scripting in Frontend Login Mailer", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-31049", "STATE": "PUBLIC", "TITLE": "Cross-Site Scripting in Frontend Login Mailer"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "typo3", "version": {"version_data": [{"version_value": ">= 9.0.0, < 9.5.34"}, {"version_value": ">= 10.0.0, < 10.4.29"}, {"version_value": ">= 11.0.0, < 11.5.11"}]}}]}, "vendor_name": "TYPO3"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm", "refsource": "CONFIRM", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm"}, {"name": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d", "refsource": "MISC", "url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d"}, {"name": "https://typo3.org/security/advisory/typo3-core-sa-2022-004", "refsource": "MISC", "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004"}]}, "source": {"advisory": "GHSA-h4mx-xv96-2jgm", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:03:40.221Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:05:18.598722Z", "id": "CVE-2022-31049", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T18:15:37.089Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-31049", "datePublished": "2022-06-14T20:50:12.000Z", "dateReserved": "2022-05-18T00:00:00.000Z", "dateUpdated": "2025-04-23T18:15:37.089Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:03:40.221Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-31049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T14:05:18.598722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:05:19.831Z"}}], "cna": {"title": "Cross-Site Scripting in Frontend Login Mailer", "source": {"advisory": "GHSA-h4mx-xv96-2jgm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "TYPO3", "product": "typo3", "versions": [{"status": "affected", "version": ">= 9.0.0, < 9.5.34"}, {"status": "affected", "version": ">= 10.0.0, < 10.4.29"}, {"status": "affected", "version": ">= 11.0.0, < 11.5.11"}]}], "references": [{"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d", "tags": ["x_refsource_MISC"]}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-06-14T20:50:12.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, "source": {"advisory": "GHSA-h4mx-xv96-2jgm", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": ">= 9.0.0, < 9.5.34"}, {"version_value": ">= 10.0.0, < 10.4.29"}, {"version_value": ">= 11.0.0, < 11.5.11"}]}, "product_name": "typo3"}]}, "vendor_name": "TYPO3"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm", "name": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm", "refsource": "CONFIRM"}, {"url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d", "name": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d", "refsource": "MISC"}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004", "name": "https://typo3.org/security/advisory/typo3-core-sa-2022-004", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-31049", "STATE": "PUBLIC", "TITLE": "Cross-Site Scripting in Frontend Login Mailer", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-31049", "state": "PUBLISHED", "dateUpdated": "2025-04-23T18:15:37.089Z", "dateReserved": "2022-05-18T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-06-14T20:50:12.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "typo3", "vendor": "TYPO3", "versions": [{"status": "affected", "version": ">= 9.0.0, < 9.5.34"}, {"status": "affected", "version": ">= 10.0.0, < 10.4.29"}, {"status": "affected", "version": ">= 11.0.0, < 11.5.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:elts:*:*:*", "matchCriteriaId": "83732441-A020-4401-A274-067B95354BB6", "versionEndExcluding": "9.5.35", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "272C6A8B-94DB-4A74-BB3A-24CD0486DFA7", "versionEndExcluding": "10.4.29", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "772D645D-5158-416C-BF2C-74E5E43EF1DC", "versionEndExcluding": "11.5.11", "versionStartIncluding": "11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem."}, {"lang": "es", "value": "TYPO3 es un sistema de administraci\u00f3n de contenidos web de c\u00f3digo abierto. En versiones anteriores a 9.5.34 ELTS, 10.4.29 y 11.5.11, los contenidos enviados por los usuarios son usados sin ser codificados correctamente en los correos electr\u00f3nicos HTML enviados a los usuarios. Los componentes realmente afectados eran los clientes de correo usados para visualizar esos mensajes. TYPO3 versiones 9.5.34 ELTS, 10.4.29 y 11.5.11 contienen una correcci\u00f3n del problema"}], "id": "CVE-2022-31049", "lastModified": "2026-06-17T04:44:41.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-31049", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T14:05:18.598722Z", "version": "2.0.3"}}]}, "published": "2022-06-14T21:15:16.183", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-004"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}