GitHub Advisoryadvisory · Packagist
GHSA-9j8h-xrgj-7gw2 TYPO3 Improper Session Invalidation
MEDIUM
Official page ↗
- Aliases
- CVE-2014-3944
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- Moderate
- Weaknesses
- CWE-287
- Reviewed
- 2024-04-25
Affected packages
• Packagist typo3/cms: >= 6.2.0, < 6.2.3 → fixed in 6.2.3
Description
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2014-3944 The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3944 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3944.yaml web
- https://github.com/TYPO3/typo3 package
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 web
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 web
- http://www.debian.org/security/2014/dsa-2942 web
- http://www.openwall.com/lists/oss-security/2014/06/03/2 web