{"id":"CVE-2022-23500","aliases":["BIT-typo3-2022-23500","EUVD-2022-7562","GHSA-8c28-5mp7-v24h"],"status":"published","title":"TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service","description":"TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00731,"percentile":0.54622,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-405","CWE-674"],"published":"2022-12-13T17:02:09Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms-core","fixed_in":["9.5.38","10.4.33","11.5.20"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["10.4.33","11.5.20"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"typo3","fixed_in":["9.5.38","10.4.33","11.5.20"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.38"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.4.33"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.5.20"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.4.33"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.5.20"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"typo3","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.5.38"},{"introduced":"10.0.0"},{"fixed":"10.4.33"},{"introduced":"11.0.0"},{"fixed":"11.5.20"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.38"}]}],"versions":["v9.0.0","v9.1.0","v9.2.0","v9.2.1","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.4.0","v9.5.0","v9.5.1","v9.5.10","v9.5.11","v9.5.12","v9.5.13","v9.5.14","v9.5.15","v9.5.16","v9.5.17","v9.5.18","v9.5.19","v9.5.2","v9.5.20","v9.5.21","v9.5.22","v9.5.23","v9.5.24","v9.5.25","v9.5.26","v9.5.27","v9.5.28","v9.5.29","v9.5.3","v9.5.30","v9.5.31","v9.5.4","v9.5.5","v9.5.6","v9.5.7","v9.5.8","v9.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.4.33"}]}],"versions":["v10.0.0","v10.1.0","v10.2.0","v10.2.1","v10.2.2","v10.3.0","v10.4.0","v10.4.1","v10.4.10","v10.4.11","v10.4.12","v10.4.13","v10.4.14","v10.4.15","v10.4.16","v10.4.17","v10.4.18","v10.4.19","v10.4.2","v10.4.20","v10.4.21","v10.4.22","v10.4.23","v10.4.24","v10.4.25","v10.4.26","v10.4.27","v10.4.28","v10.4.29","v10.4.3","v10.4.30","v10.4.31","v10.4.32","v10.4.4","v10.4.5","v10.4.6","v10.4.7","v10.4.8","v10.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.5.20"}]}],"versions":["v11.0.0","v11.1.0","v11.1.1","v11.2.0","v11.3.0","v11.3.1","v11.3.2","v11.3.3","v11.4.0","v11.5.0","v11.5.1","v11.5.10","v11.5.11","v11.5.12","v11.5.13","v11.5.14","v11.5.15","v11.5.16","v11.5.17","v11.5.18","v11.5.19","v11.5.2","v11.5.3","v11.5.4","v11.5.5","v11.5.6","v11.5.7","v11.5.8","v11.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.4.33"}]}],"versions":["v10.0.0","v10.1.0","v10.2.0","v10.2.1","v10.2.2","v10.3.0","v10.4.0","v10.4.1","v10.4.10","v10.4.11","v10.4.12","v10.4.13","v10.4.14","v10.4.15","v10.4.16","v10.4.17","v10.4.18","v10.4.19","v10.4.2","v10.4.20","v10.4.21","v10.4.22","v10.4.23","v10.4.24","v10.4.25","v10.4.26","v10.4.27","v10.4.28","v10.4.29","v10.4.3","v10.4.30","v10.4.31","v10.4.32","v10.4.4","v10.4.5","v10.4.6","v10.4.7","v10.4.8","v10.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.5.20"}]}],"versions":["v11.0.0","v11.1.0","v11.1.1","v11.2.0","v11.3.0","v11.3.1","v11.3.2","v11.3.3","v11.4.0","v11.5.0","v11.5.1","v11.5.10","v11.5.11","v11.5.12","v11.5.13","v11.5.14","v11.5.15","v11.5.16","v11.5.17","v11.5.18","v11.5.19","v11.5.2","v11.5.3","v11.5.4","v11.5.5","v11.5.6","v11.5.7","v11.5.8","v11.5.9"]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"https://github.com/TYPO3/typo3/security/advisories/GHSA-8c28-5mp7-v24h","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://github.com/TYPO3/typo3/commit/1e5f44417f031c9c5a9f9d09a6a841cf89aa7b7a","tags":["web"]},{"url":"https://github.com/TYPO3/typo3/commit/73b46b6a627093112cfca4b895a198ca5e1970b7","tags":["web"]},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2022-012","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23500.yaml","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23500","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8c28-5mp7-v24h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23500.json","tags":["advisory"]},{"url":"https://github.com/TYPO3/typo3","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-23500","title":"TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service","description":"TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.","status":"published","published":"2022-12-14T07:07:05.039Z","modified":"2025-04-21T14:54:11.819Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-7562","description":"TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.","status":"published","published":"2022-12-14T07:07:05Z","modified":"2025-04-21T14:54:11Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-8c28-5mp7-v24h","title":"TYPO3 CMS vulnerable to Denial of Service in Page Error Handling","description":"### Problem\nRequesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.\n\nThis vulnerability is very similar, but not identical, to the one described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) (CVE-2021-21359).\n\n### Solution\nUpdate to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above.\n\n### References\n* [TYPO3-CORE-SA-2022-012](https://typo3.org/security/advisory/typo3-core-sa-2022-012)","status":"published","published":"2022-12-13T17:02:09Z","modified":"2023-01-30T05:05:48Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-405","CWE-674"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-23500","description":"TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.","status":"published","published":"2022-12-14T08:15:09.427Z","modified":"2026-06-17T04:30:14.8Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"CVE-2022-23500","title":"TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service","description":"TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.","status":"published","published":"2022-12-14T07:07:05.039Z","modified":"2026-10-28T02:30:59.830368911Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-8c28-5mp7-v24h","title":"TYPO3 CMS vulnerable to Denial of Service in Page Error Handling","description":"### Problem\nRequesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.\n\nThis vulnerability is very similar, but not identical, to the one described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) (CVE-2021-21359).\n\n### Solution\nUpdate to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above.\n\n### References\n* [TYPO3-CORE-SA-2022-012](https://typo3.org/security/advisory/typo3-core-sa-2022-012)","status":"published","published":"2022-12-13T17:02:09Z","modified":"2023-12-06T01:01:58.715446Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-405","CWE-674"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"BIT-typo3-2022-23500","description":"TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.","status":"published","published":"2024-03-06T11:10:10.414Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:36.104787Z"}]}}