CVE-2022-36104

{"containers": {"cna": {"affected": [{"product": "typo3", "vendor": "TYPO3", "versions": [{"status": "affected", "version": ">= 11.4.0, < 11.5.16"}]}], "descriptions": [{"lang": "en", "value": "TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-13T17:20:19.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13"}, {"tags": ["x_refsource_MISC"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006"}], "source": {"advisory": "GHSA-fffr-7x4x-f98q", "discovery": "UNKNOWN"}, "title": "Denial of Service via Page Error Handling in TYPO3/cms", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-36104", "STATE": "PUBLIC", "TITLE": "Denial of Service via Page Error Handling in TYPO3/cms"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "typo3", "version": {"version_data": [{"version_value": ">= 11.4.0, < 11.5.16"}]}}]}, "vendor_name": "TYPO3"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}]}, "references": {"reference_data": [{"name": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q", "refsource": "CONFIRM", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q"}, {"name": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13", "refsource": "MISC", "url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13"}, {"name": "https://typo3.org/security/advisory/typo3-core-sa-2022-006", "refsource": "MISC", "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006"}]}, "source": {"advisory": "GHSA-fffr-7x4x-f98q", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:52:00.655Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:00:50.954391Z", "id": "CVE-2022-36104", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T17:11:38.269Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-36104", "datePublished": "2022-09-13T17:20:19.000Z", "dateReserved": "2022-07-15T00:00:00.000Z", "dateUpdated": "2025-04-23T17:11:38.269Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:52:00.655Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-36104", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T14:00:50.954391Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:00:52.687Z"}}], "cna": {"title": "Denial of Service via Page Error Handling in TYPO3/cms", "source": {"advisory": "GHSA-fffr-7x4x-f98q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "TYPO3", "product": "typo3", "versions": [{"status": "affected", "version": ">= 11.4.0, < 11.5.16"}]}], "references": [{"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13", "tags": ["x_refsource_MISC"]}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-09-13T17:20:19.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, "source": {"advisory": "GHSA-fffr-7x4x-f98q", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": ">= 11.4.0, < 11.5.16"}]}, "product_name": "typo3"}]}, "vendor_name": "TYPO3"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q", "name": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q", "refsource": "CONFIRM"}, {"url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13", "name": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13", "refsource": "MISC"}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006", "name": "https://typo3.org/security/advisory/typo3-core-sa-2022-006", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-36104", "STATE": "PUBLIC", "TITLE": "Denial of Service via Page Error Handling in TYPO3/cms", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-36104", "state": "PUBLISHED", "dateUpdated": "2025-04-23T17:11:38.269Z", "dateReserved": "2022-07-15T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-09-13T17:20:19.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "typo3", "vendor": "TYPO3", "versions": [{"status": "affected", "version": ">= 11.4.0, < 11.5.16"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "13B1EBA5-8D98-4595-93CB-03A0C3611DA1", "versionEndIncluding": "11.5.15", "versionStartIncluding": "11.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue."}, {"lang": "es", "value": "TYPO3 es un sistema de administraci\u00f3n de contenidos web de c\u00f3digo abierto basado en PHP y publicado bajo la licencia GNU GPL. En versiones afectadas, la petici\u00f3n de recursos no v\u00e1lidos o inexistentes por medio de HTTP desencadena el manejador de errores de la p\u00e1gina que, de nuevo, podr\u00eda recuperar el contenido para mostrarlo como un mensaje de error desde otra p\u00e1gina. Esto conlleva a un escenario en el que la aplicaci\u00f3n es llamado a si mismo de forma recursiva, amplificando el impacto del ataque inicial hasta que son superados los l\u00edmites del servidor web. Es recomendado a usuarios actualizar a TYPO3 versi\u00f3n 11.5.16 para resolver este problema. No se presentan mitigaciones conocidas para este problema"}], "id": "CVE-2022-36104", "lastModified": "2026-06-17T04:52:55.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-36104", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T14:00:50.954391Z", "version": "2.0.3"}}]}, "published": "2022-09-13T18:15:14.703", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2022-006"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}