GitHub Advisoryadvisory · Packagist

GHSA-ppvg-hw62-6ph9 TYPO3 Security Misconfiguration in Install Tool Cookie

HIGH Published 2024-05-30 Modified 2024-05-30 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1004
Reviewed
2024-05-30

Affected packages

• Packagist typo3/cms-core: >= 8.0.0, < 8.7.21 → fixed in 8.7.21 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.2 → fixed in 9.5.2 • Packagist typo3/cms-core: >= 7.0.0, < 7.6.32 → fixed in 7.6.32

Description

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.

Related

Weakness · CWE (1)

  • CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag weakness

References