Log in Start free

Vulnerability · Published Dec 14, 2022 · Assigned by GitHub_M

CVE-2022-23501TYPO3 vulnerable to Improper Authentication in Frontend Login

Medium 5.9

In plain English

A medium-severity improper authentication in typo3 from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms10.4.33GHSA-jfp7-79g7-89rf
Packagisttypo3/cms11.5.20GHSA-jfp7-79g7-89rf
Packagisttypo3/cms12.1.1GHSA-jfp7-79g7-89rf
Packagisttypo3/cms-core11.5.20GHSA-jfp7-79g7-89rf
Packagisttypo3/cms-core8.7.49GHSA-jfp7-79g7-89rf
Packagisttypo3/cms-core12.1.1GHSA-jfp7-79g7-89rf
Packagisttypo3/cms-core9.5.38GHSA-jfp7-79g7-89rf
Packagisttypo3/cms-core10.4.33GHSA-jfp7-79g7-89rf

Affected products (as reported)

VendorProductVersions
TYPO3 typo3 >= 8.0.0, < 8.7.49>= 9.0.0, < 9.5.38>= 10.0.0, < 10.4.33>= 11.0.0, < 11.5.20>= 12.0.0, < 12.1.1

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References