Medium severity6.5NVD Advisory· Published Sep 13, 2022· Updated Jun 17, 2026
CVE-2022-36108
CVE-2022-36108
Description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-corePackagist | >= 10.3.0, < 10.4.32 | 10.4.32 |
typo3/cms-corePackagist | >= 11.0.0, < 11.5.16 | 11.5.16 |
typo3/cmsPackagist | >= 10.3.0, < 10.4.32 | 10.4.32 |
typo3/cmsPackagist | >= 11.0.0, < 11.5.16 | 11.5.16 |
Affected products
4- osv-coords3 versions
>= 10.0.0, < 10.4.31+ 2 more
- (no CPE)range: >= 10.0.0, < 10.4.31
- (no CPE)range: >= 10.3.0, < 10.4.32
- (no CPE)range: >= 10.3.0, < 10.4.32
Patches
Vulnerability mechanics
References
8- github.com/TYPO3/typo3/commit/6863f73818c36b0b88c677ba533765c8074907b4nvdPatchThird Party AdvisoryWEB
- github.com/TYPO3/typo3/security/advisories/GHSA-fv2m-9249-qx85nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-fv2m-9249-qx85ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-36108ghsaADVISORY
- typo3.org/security/advisory/typo3-core-sa-2022-010nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36108.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36108.yamlghsaWEB
- github.com/TYPO3/typo3/commit/c62e16fac031c270d9759c7261e504c7e25405dfghsaWEB
News mentions
0No linked articles in our index yet.