{"id":"GHSA-gvxv-p9rv-gmcg","aliases":["BIT-matomo-2022-33156","CVE-2022-33156"],"title":"brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.","severity":"medium","score":6.1,"published":"2022-06-17T21:46:28.000Z","modified":"2023-12-06T01:02:22.224Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"brotkrueml/typo3-matomo-integration","sources":[{"name":"OSV · GHSA-gvxv-p9rv-gmcg","url":"https://osv.dev/vulnerability/GHSA-gvxv-p9rv-gmcg"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.2"}],"type":"ECOSYSTEM"}],"versions":["v1.0.0","v1.0.1","v1.1.0","v1.2.0","v1.3.0","v1.3.1"],"fixed":["1.3.2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-33156","https://github.com/FriendsOfPHP/security-advisories/blob/master/brotkrueml/typo3-matomo-integration/CVE-2022-33156.yaml","https://github.com/brotkrueml/typo3-matomo-integration","https://typo3.org/security/advisory/typo3-ext-sa-2022-011"],"sources":[{"name":"OSV","id":"GHSA-gvxv-p9rv-gmcg","modified":"2023-12-06T01:02:22.224591Z","url":"https://osv.dev/vulnerability/GHSA-gvxv-p9rv-gmcg"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T04:20:33.105Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}