{"id":"CVE-2022-35628","aliases":["EUVD-2022-6412","GHSA-rpxg-hg79-h8q9"],"status":"published","title":"SQL Injection in typo3 extension \"LUX - TYPO3 Marketing Automation\"","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.26821,"percentile":0.98046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2022-07-12T22:01:37Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Packagist","package":"in2code/lux","fixed_in":["24.0.2","17.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"in2code/lux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"24.0.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"in2code/lux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"in2code/lux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"24.0.2"}]}],"versions":["18.0.0","18.1.0","18.1.1","19.0.0","19.0.1","19.0.2","19.0.3","20.0.0","20.0.1","20.1.0","20.2.0","20.2.1","20.2.2","21.0.0","21.1.0","21.2.0","21.3.0","21.4.0","22.0.0","22.1.0","22.2.0","22.3.0","22.3.1","22.3.2","22.3.3","22.4.0","22.5.0","22.6.0","23.0.0","23.1.0","23.2.0","23.2.1","23.3.0","24.0.0","24.0.1"]},{"source":"osv","ecosystem":"Packagist","package":"in2code/lux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6.1"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.1.0","10.2.0","10.3.0","10.3.1","10.3.2","10.3.3","11.0.0","11.1.0","11.2.0","11.2.1","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.6.0","11.7.0","11.7.1","11.8.0","12.0.0","13.0.0","13.1.0","13.2.0","13.3.0","13.4.0","13.4.1","13.4.2","14.0.0","14.0.1","14.0.2","14.0.3","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.4.0","14.4.1","14.4.2","15.0.0","15.0.1","15.0.2","15.0.3","15.1.0","15.2.0","15.2.1","15.2.2","15.3.0","15.3.1","16.0.0","16.0.1","16.0.2","17.0.0","17.0.1","17.0.2","17.1.0","17.1.1","17.1.2","17.2.0","17.2.1","17.2.2","17.2.3","17.3.0","17.4.0","17.4.1","17.5.0","17.6.0","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.5.0","3.0.0","4.0.0","4.1.0","4.1.1","4.1.2","4.1.3","5.0.0","5.1.0","6.0.0","6.1.0","6.2.0","6.3.0","7.0.0","7.0.1","7.0.2","7.1.0","7.2.0","7.2.1","7.2.2","7.2.3","7.3.0","8.0.0","8.0.1","8.1.0","8.1.1","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.1.1","9.1.2"]}],"products":[{"vendor":"in2code","product":"living_user_experience"}],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2022-014","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35628","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/lux/CVE-2022-35628.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rpxg-hg79-h8q9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35628.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35628","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","status":"published","published":"2022-07-12T22:01:37Z","modified":"2024-08-03T09:36:44.409Z","updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-6412","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","status":"published","published":"2022-07-12T22:01:37Z","modified":"2024-08-03T09:36:44Z","updated_at":"2026-11-03T03:25:26.818953Z"}],"ghsa":[{"id":"GHSA-rpxg-hg79-h8q9","title":"SQL Injection in typo3 extension \"LUX - TYPO3 Marketing Automation\"","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","status":"published","published":"2022-07-15T15:28:26Z","modified":"2023-01-27T05:06:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:36:21.8171Z"}],"nvd":[{"id":"CVE-2022-35628","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","status":"published","published":"2022-07-12T23:15:14.093Z","modified":"2026-06-17T04:52:00.007Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:23.322724Z"}],"osv":[{"id":"GHSA-rpxg-hg79-h8q9","title":"SQL Injection in typo3 extension \"LUX - TYPO3 Marketing Automation\"","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","status":"published","published":"2022-07-15T15:28:26Z","modified":"2023-11-08T04:09:51.512093Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"CVE-2022-35628","description":"A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.","status":"published","published":"2022-07-12T22:01:37Z","modified":"2026-10-28T02:30:54.671849765Z","updated_at":"2026-11-02T15:44:26.195407Z"}]}}