Log in Start free

Vulnerability · Published Dec 14, 2022 · Assigned by GitHub_M

CVE-2022-23502TYPO3 contains Insufficient Session Expiration after Password Reset

Medium 5.4

In plain English

A medium-severity security flaw in typo3 from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 62.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms10.4.33GHSA-mgj2-q8wp-29rr
Packagisttypo3/cms11.5.20GHSA-mgj2-q8wp-29rr
Packagisttypo3/cms12.1.1GHSA-mgj2-q8wp-29rr
Packagisttypo3/cms-core10.4.33GHSA-mgj2-q8wp-29rr
Packagisttypo3/cms-core11.5.20GHSA-mgj2-q8wp-29rr
Packagisttypo3/cms-core12.1.1GHSA-mgj2-q8wp-29rr

Affected products (as reported)

VendorProductVersions
TYPO3 typo3 >= 10.0.0, < 10.4.33>= 11.0.0, < 11.5.20>= 12.0.0, < 12.1.1

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References