GitHub Advisoryadvisory · Packagist

GHSA-53mm-hx32-6475 TYPO3 vulnerable to Insufficient Session Expiration

CRITICAL Published 2022-12-14 Modified 2022-12-19 Official page ↗
Aliases
CVE-2022-47406
Ecosystem
Packagist
Packages
typo3/cms, derhansen/fe_change_pwd
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-613
Reviewed
2022-12-19

Affected packages

• Packagist typo3/cms: < 2.0.5 → fixed in 2.0.5 • Packagist typo3/cms: >= 3.0.0, < 3.0.3 → fixed in 3.0.3 • Packagist derhansen/fe_change_pwd: >= 3.0.0, < 3.0.3 → fixed in 3.0.3 • Packagist derhansen/fe_change_pwd: < 2.0.5 → fixed in 2.0.5

Description

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2022-47406 An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for… vulnerability

References