GitHub Advisoryadvisory · Packagist

GHSA-q45q-5233-229p Authentication library in TYPO3 vulnerable to session fixation

HIGH Published 2022-05-02 Modified 2024-01-23 Official page ↗
Aliases
CVE-2009-0256
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
Weaknesses
CWE-287, CWE-384
Reviewed
2024-01-23

Affected packages

• Packagist typo3/cms: >= 4.0.0, < 4.0.10 → fixed in 4.0.10 • Packagist typo3/cms: >= 4.1.0, < 4.1.8 → fixed in 4.1.8 • Packagist typo3/cms: >= 4.2.0, < 4.2.4 → fixed in 4.2.4

Description

Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.

Related

Alias · CVE (1)

  • CVE-2009-0256 Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-384 Session Fixation weakness

References