Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / packagist/typo3/cms-core/CVE-2022-23503
Advisory ID gitlab/packagist/typo3/cms-core/CVE-2022-23503
Aliases CVE-2022-23503
GHSA-c5wx-6c2c-f7rm
GMS-2022-8132
Summary Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 is vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (4)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-core/CVE-2022-23503.yml
Reference id Reference type URL
https://github.com/TYPO3/typo3/commit/1302e88565821f2159e08b5d818d28de17ecc830
https://typo3.org/security/advisory/typo3-core-sa-2022-015
CVE-2022-23503 https://nvd.nist.gov/vuln/detail/CVE-2022-23503
GHSA-c5wx-6c2c-f7rm https://github.com/advisories/GHSA-c5wx-6c2c-f7rm
GHSA-c5wx-6c2c-f7rm https://github.com/TYPO3/typo3/security/advisories/GHSA-c5wx-6c2c-f7rm
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-core/CVE-2022-23503.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-18T18:23:57Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/23xxx/CVE-2022-23503.json

Source Advisory: vulnrichment/CVE-2022-23503

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]