GitHub Advisoryadvisory · Packagist

GHSA-qx3w-4864-94ch Cleartext storage of session identifier

MEDIUM Published 2021-03-23 Modified 2021-03-29 Official page ↗
Aliases
CVE-2021-21339
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312
Reviewed
2021-03-23

Affected packages

• Packagist typo3/cms-core: >= 6.2.0, < 6.2.57 → fixed in 6.2.57 • Packagist typo3/cms-core: >= 7.0.0, < 7.6.51 → fixed in 7.6.51 • Packagist typo3/cms-core: >= 8.0.0, < 8.7.40 → fixed in 8.7.40 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms-core: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.25 → fixed in 9.5.25 • Packagist typo3/cms: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms: >= 9.0.0, < 9.5.25 → fixed in 9.5.25

Description

Problem User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue. References • TYPO3-CORE-SA-2021-006

Related

Alias · CVE (1)

  • CVE-2021-21339 TYPO3 is an open source PHP based web content management system. vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References