Security readout for executives and security teams
Plain-English summary
CVE-2022-35628 is a SQL injection vulnerability in the TYPO3 lux extension. For organizations using TYPO3 with lux installed, this could affect the integrity or confidentiality of website data depending on how the vulnerable extension is exposed and configured.
Executive priority
Prioritize assessment if TYPO3 is business-critical or externally exposed. Because severity and exploit evidence are incomplete in the provided sources, urgency should be driven by asset exposure, data sensitivity, and whether vulnerable lux versions are present.
Technical view
The CVE record reports SQL injection in the TYPO3 lux extension before 17.6.1, and versions 18.x through 24.x before 24.0.2. The provided bundle does not include CVSS, CWE, affected CPEs, exploit prerequisites, or detailed vulnerable endpoints.
Likely exposure
Exposure is limited to TYPO3 environments that have the lux extension installed in an affected version. The source bundle does not identify affected deployment patterns, authentication requirements, or public route details.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Treat exploit status as unconfirmed, not absent.
Researcher notes
Key gaps are CVSS, CWE, endpoint details, exploit prerequisites, and affected CPEs. Validation should focus on accurate extension inventory and version comparison, while avoiding assumptions beyond the TYPO3 advisory and CVE description.
Mitigation direction
- Check the TYPO3 advisory for exact affected lux versions.
- Upgrade lux to 17.6.1, 24.0.2, or a later vendor-supported version.
- Inventory TYPO3 sites for installed lux extension versions.
- Prioritize internet-facing TYPO3 sites and sites handling sensitive data.
Validation and detection
- Confirm whether each TYPO3 instance has the lux extension installed.
- Record the installed lux version for every TYPO3 site.
- Compare versions against the affected ranges in the CVE record.
- Review vendor advisory notes for any configuration-specific guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-35628 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://typo3.org/security/advisory/typo3-ext-sa-2022-014CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.