CVE-2022-31048: Cross-Site Scripting in TYPO3's Form Framework
5.4
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.71907%
CWE
Published
6/17/2022
Updated
1/27/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.47 | 8.7.47 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.35 | 9.5.35 |
| typo3/cms-core | composer | >= 10.0.0, < 10.4.29 | 10.4.29 |
| typo3/cms-core | composer | >= 11.0.0, < 11.5.11 | 11.5.11 |
| typo3/cms | composer | >= 10.0.0, < 10.4.29 | 10.4.29 |
| typo3/cms | composer | >= 11.0.0, < 11.5.11 | 11.5.11 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The commit diff shows critical XSS fixes replacing dangerous .html()/.append() calls with .text()/document.createTextNode(). Specifically:
- setStageHeadline() previously used .html(title) with unprocessed user input
- Multiple template property handlers directly appended user-controlled values like form element labels and identifiers without sanitization These patterns match classic DOM-based XSS vulnerabilities where attacker-controlled input flows into HTML injection sinks without proper encoding.