CVE-2022-23504: 
PHP vulnerability analysis and mitigation

TYPO3, an open source PHP-based web content management system, was found to have a sensitive information disclosure vulnerability (CVE-2022-23504) affecting versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1. The vulnerability was discovered and disclosed in December 2022, with patches released in the same timeframe (GHSA Advisory).

The vulnerability stems from improper handling of user-submitted YAML placeholder expressions in the site configuration backend module. It has been assigned a CVSS v3.1 base score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The vulnerability is categorized under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

If exploited, the vulnerability could allow attackers to expose sensitive internal information, including system configuration details and HTTP request messages of other website visitors (GHSA Advisory).

Exploitation of this vulnerability requires a valid backend user account with administrator privileges. The attack complexity is considered low, but high privileges are required for successful exploitation (GHSA Advisory).

The vulnerability has been patched in TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, and 12.1.1. Users are advised to update to these patched versions to address the security issue (GHSA Advisory).