GitHub Advisoryadvisory · Packagist

GHSA-g9rv-6g56-65h8 Typo3 Security Misconfiguration in User Session Handling

MEDIUM Published 2024-06-05 Modified 2024-06-05 Official page ↗

Ecosystem: Packagist
Packages: typo3/cms
Severity: Moderate
Reviewed: 2024-06-05

Affected packages

• Packagist typo3/cms: >= 8.0.0, < 8.7.25 → fixed in 8.7.25 • Packagist typo3/cms: >= 9.0.0, < 9.5.6 → fixed in 9.5.6

Description

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability.

References

https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-05-07-2.yaml web
https://github.com/TYPO3/typo3 package
https://typo3.org/security/advisory/typo3-core-sa-2019-011 web