GitHub Advisoryadvisory · Packagist

GHSA-5959-4x58-r8c2 TYPO3 CMS missing check for expiration time of password reset token for backend users

MEDIUM Published 2022-09-16 Modified 2022-09-16 Official page ↗
Aliases
CVE-2022-36106
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287
Reviewed
2022-09-16

Affected packages

• Packagist typo3/cms-core: >= 10.4.0, < 10.4.32 → fixed in 10.4.32 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.16 → fixed in 11.5.16 • Packagist typo3/cms: >= 10.4.0, < 10.4.32 → fixed in 10.4.32 • Packagist typo3/cms: >= 11.0.0, < 11.5.16 → fixed in 11.5.16

Description

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0) Problem It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Ingo Fabbri who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. References • TYPO3-CORE-SA-2022-008

Related

Alias · CVE (1)

  • CVE-2022-36106 TYPO3 is an open source PHP based web content management system released under the GNU GPL. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References