Vulnerability · Published Jun 14, 2022 · Assigned by GitHub_M

CVE-2022-31050Insufficient Session Expiration in TYPO3 Admin Tool

Medium 6.0

In plain English

A medium-severity security flaw in typo3 from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)1.3%top 30.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms	10.4.29	GHSA-wwjw-r3gj-39fq
Packagist	typo3/cms	11.5.11	GHSA-wwjw-r3gj-39fq
Packagist	typo3/cms-core	9.5.35	GHSA-wwjw-r3gj-39fq
Packagist	typo3/cms-core	10.4.29	GHSA-wwjw-r3gj-39fq
Packagist	typo3/cms-core	11.5.11	GHSA-wwjw-r3gj-39fq

Affected products (as reported)

Vendor	Product	Versions
TYPO3	typo3	>= 9.0.0, < 9.5.34>= 10.0.0, < 10.4.29>= 11.0.0, < 11.5.11

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq x_refsource_CONFIRM
https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d x_refsource_MISC
https://typo3.org/security/advisory/typo3-core-sa-2022-005 x_refsource_MISC