CVE-2022-36105— TYPO3 安全漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2022-36105の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
User Enumeration via Response Timing in TYPO3
ソース: NVD (National Vulnerability Database)
脆弱性説明
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
通过差异性导致的信息暴露
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
TYPO3 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
TYPO3是瑞士TYPO3协会的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3存在安全漏洞。攻击者利用该漏洞在用户身份验证（后端和前端）期间观察响应时间可区分现有和不存在的用户帐户。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2022-36105の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2022-36105のインテリジェンス情報
请登录查看更多情报信息。
- User Enumeration via Response Timing · Advisory · TYPO3/typo3 · GitHubx_refsource_CONFIRM
- https://typo3.org/security/advisory/typo3-core-sa-2022-007x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2022-36105
Same Patch Batch · TYPO3 · 2022-09-13 · 6 CVEs total
| CVE-2022-36107 | 6.5 MEDIUM | Stored Cross-Site Scripting via FileDumpController |
| CVE-2022-36108 | 6.5 MEDIUM | Cross-Site Scripting in typo3/cms-core |
| CVE-2022-36020 | 6.1 MEDIUM | Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer |
| CVE-2022-36104 | 5.9 MEDIUM | Denial of Service via Page Error Handling in TYPO3/cms |
| CVE-2022-36106 | 5.4 MEDIUM | Missing check for expiration time of password reset token in TYPO3 |
IV. 関連脆弱性
同じ製品: typo3
- CVE-2025-47941
TYPO3 Has Broken Authentication in Backend MFA - CVE-2025-47940
TYPO3 CMS Vulnerable to Privilege Escalation to System Maint - CVE-2025-47939
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abs - CVE-2025-47938
TYPO3 Vulnerable to Unverified Password Change for Backend U - CVE-2025-47937
TYPO3 Vulnerable to Information Disclosure via DBAL Restrict
同じベンダー: TYPO3
- CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module - CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mf - CVE-2026-4202
Broken Access Control in extension "Redirect Tab" - CVE-2026-1323
Insecure Deserialization in extension "Mailqueue" (mailqueue - CVE-2026-0895
Insecure Deserialization in extension "Mailqueue" (mailqueue
同じ弱点: CWE-203
- CVE-2026-44263
Weblate: Private Translation Enumeration via Screenshot API - CVE-2023-5872
Wago: Vulnerability in Smart Designer Web-Application - CVE-2026-33429
Parse Server: Protected field change detection oracle via Li - CVE-2026-33425
Discourse has inferable private group membership or existenc - CVE-2026-3580
Compiler-induced timing leak in sp_256_get_entry_256_9 on RI
V. CVE-2022-36105へのコメント
まだコメントはありません