Medium severity4.3NVD Advisory· Published Jun 14, 2022· Updated Jun 17, 2026
CVE-2022-31046
CVE-2022-31046
Description
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-corePackagist | >= 7.0.0, < 7.6.57 | 7.6.57 |
typo3/cms-corePackagist | >= 8.0.0, < 8.7.47 | 8.7.47 |
typo3/cms-corePackagist | >= 9.0.0, < 9.5.35 | 9.5.35 |
typo3/cms-corePackagist | >= 10.0.0, < 10.4.29 | 10.4.29 |
typo3/cms-corePackagist | >= 11.0.0, < 11.5.11 | 11.5.11 |
typo3/cmsPackagist | >= 10.0.0, < 10.4.29 | 10.4.29 |
typo3/cmsPackagist | >= 11.0.0, < 11.5.11 | 11.5.11 |
Affected products
4- osv-coords3 versions
>= 7.0.0, < 7.6.57+ 2 more
- (no CPE)range: >= 7.0.0, < 7.6.57
- (no CPE)range: >= 10.0.0, < 10.4.29
- (no CPE)range: >= 7.0.0, < 7.6.57
Patches
Vulnerability mechanics
References
7- github.com/TYPO3/typo3/commit/7447a3d1283017d2ee08737a7972c720001a93e9nvdPatchThird Party AdvisoryWEB
- github.com/TYPO3/typo3/security/advisories/GHSA-8gmv-9hwg-w89gnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-8gmv-9hwg-w89gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-31046ghsaADVISORY
- typo3.org/security/advisory/typo3-core-sa-2022-001nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-31046.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-31046.yamlghsaWEB
News mentions
0No linked articles in our index yet.