Vulnerability advisory

CVE-2022-23502

TYPO3 contains Insufficient Session Expiration after Password Reset

Published Dec 14, 2022Updated Oct 28, 2026OSV record ↗

Also known as BIT-typo3-2022-23502GHSA-mgj2-q8wp-29rr

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
c91b70e450c52d29ffb08115fffbb7832b15a330 to before 8a90081d0135df5df51c49ba0b456fa3d4911720	`8a90081d0135df5df51c49ba0b456fa3d4911720`
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 7dd798416ced8107d383c4961b1c9b62b438677b	`7dd798416ced8107d383c4961b1c9b62b438677b`
36096733dea4bd6f6168209609fa879dc25c0138 to before 819260632d66317021f37c37057dc13914ff1679	`819260632d66317021f37c37057dc13914ff1679`
Also listed as affected (64) `v12.1.0` `v11.5.19` `v11.5.18` `v11.5.17` `v12.0.0` `v11.5.16` `v10.4.32` `v11.5.15` `v11.5.14` `v11.5.13` `v10.4.31` `v11.5.12` `v10.4.30` `v11.5.11` `v10.4.29` `v11.5.10` `v10.4.28` `v11.5.9` `v10.4.27` `v11.5.8` `v10.4.26` `v11.5.7` `v10.4.25` `v10.4.24` `v11.5.6` `v11.5.5` `v10.4.23` `v10.4.22` `v11.5.4` `v11.5.3` `v11.5.2` `v11.5.1` `v11.5.0` `v10.4.21` `v11.4.0` `v10.4.20` `v10.4.19` `v10.4.18` `v11.3.0` `v10.4.17` `v10.4.16` `v11.2.0` `v10.4.15` `v10.4.14` `v11.1.0` `v10.4.13` `v11.0.0` `v10.4.12` `v10.4.11` `v10.4.10` `v10.4.9` `v10.4.8` `v10.4.7` `v10.4.6` `v10.4.5` `v10.4.4` `v10.4.3` `v10.4.2` `v10.4.1` `v10.4.0` `v10.3.0` `v10.2.0` `v10.1.0` `v10.0.0`

Description

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.

CVE-2022-23502

Affected versions

Repository

Description

References