Advisory details:
github_osv / GHSA-8c28-5mp7-v24h
| Advisory ID | github_osv/GHSA-8c28-5mp7-v24h |
| Aliases |
CVE-2022-23500
|
| Summary | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling ### Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) (CVE-2021-21359). ### Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above. ### References * [TYPO3-CORE-SA-2022-012](https://typo3.org/security/advisory/typo3-core-sa-2022-012) |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.3 |
| Risk | 2.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.9 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-8c28-5mp7-v24h/GHSA-8c28-5mp7-v24h.json |
| generic_textual | MODERATE |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-21T14:53:56Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/23xxx/CVE-2022-23500.json
Source Advisory: vulnrichment/CVE-2022-23500
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]