CVE Vulnerabilities

CVE-2022-23500

Uncontrolled Recursion

Published: Dec 14, 2022 | Modified: Dec 16, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Typo3 Typo3 9.0.0 (including) 9.5.38 (excluding)
Typo3 Typo3 10.0.0 (including) 10.4.33 (excluding)
Typo3 Typo3 11.0.0 (including) 11.5.20 (excluding)
Typo3-src Ubuntu trusty *
Typo3-src Ubuntu xenial *

Potential Mitigations

References