Medium severity5.9NVD Advisory· Published Sep 13, 2022· Updated Jun 17, 2026
CVE-2022-36104
CVE-2022-36104
Description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-corePackagist | >= 11.4.0, < 11.5.16 | 11.5.16 |
typo3/cmsPackagist | >= 11.4.0, < 11.5.16 | 11.5.16 |
Affected products
4- osv-coords3 versions
>= 11.4.0, < 11.5.15+ 2 more
- (no CPE)range: >= 11.4.0, < 11.5.15
- (no CPE)range: >= 11.4.0, < 11.5.16
- (no CPE)range: >= 11.4.0, < 11.5.16
Patches
Vulnerability mechanics
References
8- github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13nvdPatchThird Party AdvisoryWEB
- github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98qnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-fffr-7x4x-f98qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-36104ghsaADVISORY
- typo3.org/security/advisory/typo3-core-sa-2022-006nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36104.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36104.yamlghsaWEB
- github.com/TYPO3/typo3/commit/fc51ccbf2bb8a8c959aa74cbceca124971e6e7fdghsaWEB
News mentions
0No linked articles in our index yet.