Vulnerability advisory

GHSA-53mm-hx32-6475

TYPO3 vulnerable to Insufficient Session Expiration

Published Dec 14, 2022Updated Nov 8, 2023OSV record ↗

Also known as CVE-2022-47406

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
All versions before 2.0.5	`2.0.5`Advisories →
`3.0.0` to before 3.0.3	`3.0.3`Advisories →

derhansen/fe_change_pwd Packagist

All derhansen/fe_change_pwd advisories →

Affected	Fixed in
`3.0.0` to before 3.0.3	`3.0.3`Advisories →
Also listed as affected (3) `3.0.0` `3.0.1` `3.0.2`
All versions before 2.0.5	`2.0.5`Advisories →
Also listed as affected (22) `1.0.0` `1.0.1` `1.1.0` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.2.6` `1.2.7` `1.3.0` `1.4.0` `1.4.1` `1.5.0` `1.5.1` `1.5.2` `2.0.0` `2.0.1` `2.0.2` `2.0.3` `2.0.4`

Description

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

GHSA-53mm-hx32-6475

Affected versions

typo3/cms Packagist

derhansen/fe_change_pwd Packagist

Description

References