CVE-2022-33157: 
PHP vulnerability analysis and mitigation

The libconnect extension for TYPO3 (versions before 7.0.8 and 8.x before 8.1.0) was identified with a Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2022-33157. The vulnerability was disclosed on June 14, 2022, and affects the extension's handling of user input in HTML context (TYPO3 Advisory).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The core issue stems from the extension's failure to properly encode user input for output in HTML context, potentially allowing malicious script execution (NVD).

The vulnerability could allow attackers to execute malicious scripts in the context of other users' browsers, potentially leading to the theft of sensitive information, session hijacking, or other client-side attacks (TYPO3 Advisory).

The vulnerability has been patched in versions 7.0.8 and 8.1.0 of the libconnect extension. Users are strongly advised to update to these versions as soon as possible. The updated versions are available through the TYPO3 extension manager (TYPO3 Advisory).