Vulnerability advisory

GHSA-mgj2-q8wp-29rr

TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset

Published Dec 13, 2022Updated Dec 6, 2023OSV record ↗

Also known as BIT-typo3-2022-23502CVE-2022-23502

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`10.0.0` to before 10.4.33	`10.4.33`Advisories →
Also listed as affected (39) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.14` `v10.4.15` `v10.4.16` `v10.4.17` `v10.4.18` `v10.4.19` `v10.4.2` `v10.4.20` `v10.4.21` `v10.4.22` `v10.4.23` `v10.4.24` `v10.4.25` `v10.4.26` `v10.4.27` `v10.4.28` `v10.4.29` `v10.4.3` `v10.4.30` `v10.4.31` `v10.4.32` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.5.20	`11.5.20`Advisories →
Also listed as affected (29) `v11.0.0` `v11.1.0` `v11.1.1` `v11.2.0` `v11.3.0` `v11.3.1` `v11.3.2` `v11.3.3` `v11.4.0` `v11.5.0` `v11.5.1` `v11.5.10` `v11.5.11` `v11.5.12` `v11.5.13` `v11.5.14` `v11.5.15` `v11.5.16` `v11.5.17` `v11.5.18` `v11.5.19` `v11.5.2` `v11.5.3` `v11.5.4` `v11.5.5` `v11.5.6` `v11.5.7` `v11.5.8` `v11.5.9`
`12.0.0` to before 12.1.1	`12.1.1`Advisories →
Also listed as affected (2) `v12.0.0` `v12.1.0`

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`10.0.0` to before 10.4.33	`10.4.33`Advisories →
Also listed as affected (39) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.14` `v10.4.15` `v10.4.16` `v10.4.17` `v10.4.18` `v10.4.19` `v10.4.2` `v10.4.20` `v10.4.21` `v10.4.22` `v10.4.23` `v10.4.24` `v10.4.25` `v10.4.26` `v10.4.27` `v10.4.28` `v10.4.29` `v10.4.3` `v10.4.30` `v10.4.31` `v10.4.32` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.5.20	`11.5.20`Advisories →
Also listed as affected (29) `v11.0.0` `v11.1.0` `v11.1.1` `v11.2.0` `v11.3.0` `v11.3.1` `v11.3.2` `v11.3.3` `v11.4.0` `v11.5.0` `v11.5.1` `v11.5.10` `v11.5.11` `v11.5.12` `v11.5.13` `v11.5.14` `v11.5.15` `v11.5.16` `v11.5.17` `v11.5.18` `v11.5.19` `v11.5.2` `v11.5.3` `v11.5.4` `v11.5.5` `v11.5.6` `v11.5.7` `v11.5.8` `v11.5.9`
`12.0.0` to before 12.1.1	`12.1.1`Advisories →
Also listed as affected (2) `v12.0.0` `v12.1.0`

Description

Problem

When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions.

Solution

Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

References

TYPO3-CORE-SA-2022-014