GitHub Advisoryadvisory · Packagist
GHSA-mgj2-q8wp-29rr TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset
MEDIUM
Official page ↗
- Aliases
- CVE-2022-23502
- Ecosystem
- Packagist
- Packages
- typo3/cms-core, typo3/cms
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-613
- Reviewed
- 2022-12-13
Affected packages
• Packagist typo3/cms-core: >= 10.0.0, < 10.4.33 → fixed in 10.4.33
• Packagist typo3/cms-core: >= 11.0.0, < 11.5.20 → fixed in 11.5.20
• Packagist typo3/cms-core: >= 12.0.0, < 12.1.1 → fixed in 12.1.1
• Packagist typo3/cms: >= 10.0.0, < 10.4.33 → fixed in 10.4.33
• Packagist typo3/cms: >= 11.0.0, < 11.5.20 → fixed in 11.5.20
• Packagist typo3/cms: >= 12.0.0, < 12.1.1 → fixed in 12.1.1
Description
Problem
When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions.
Solution
Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.
References
• TYPO3-CORE-SA-2022-014
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2022-23502 TYPO3 is an open source PHP based web content management system. vulnerability
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-mgj2-q8wp-29rr web
- https://nvd.nist.gov/vuln/detail/CVE-2022-23502 advisory
- https://github.com/TYPO3/typo3/commit/d9ffbf24fcc62068033ebb3912538347bd380a6c web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-23502.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23502.yaml web
- https://github.com/TYPO3/typo3 package
- https://typo3.org/security/advisory/typo3-core-sa-2022-014 web