Vulnerability advisory
CVE-2022-23501
TYPO3 vulnerable to Improper Authentication in Frontend Login
Also known as BIT-typo3-2022-23501GHSA-jfp7-79g7-89rf
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| c91b70e450c52d29ffb08115fffbb7832b15a330 to before 8a90081d0135df5df51c49ba0b456fa3d4911720 | 8a90081d0135df5df51c49ba0b456fa3d4911720 |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 7dd798416ced8107d383c4961b1c9b62b438677b | 7dd798416ced8107d383c4961b1c9b62b438677b |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before 819260632d66317021f37c37057dc13914ff1679 | 819260632d66317021f37c37057dc13914ff1679 |
Also listed as affected (64)
| |
Description
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.