PT-2009-1005 · Typo3 · Typo3

Marcus Krause · Published 2009-01-22 · Updated 2022-05-02 · CVE-2009-0256

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.0.0 through 4.0.9 TYPO3 versions 4.1.0 through 4.1.7 TYPO3 versions 4.2.0 through 4.2.3

Description The issue concerns a session fixation vulnerability in the authentication library. This vulnerability allows remote attackers to hijack web sessions via unspecified vectors related to frontend and backend authentication. The vulnerability may lead to a breach of confidentiality, integrity, and availability of protected information and can be exploited remotely.

Recommendations For versions 4.0.0 through 4.0.9, update to a version outside of this range to mitigate the risk. For versions 4.1.0 through 4.1.7, update to a version outside of this range to mitigate the risk. For versions 4.2.0 through 4.2.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the authentication library until a patch is available.

Fix

Session Fixation

Improper Authentication

Use of Insufficiently Random Values

Weakness Enumeration

CWE-384

CWE-287

CWE-330

Related Identifiers

BDU:2015-01426

CVE-2009-0256

DSA-1711-1

GHSA-Q45Q-5233-229P

Affected Products

Typo3

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2009-0256 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001 · Vendor Advisory
• http://debian.org/security/2009/dsa-1711 · Vendor Advisory
• http://secunia.com/advisories/33617 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0257 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0255 · Security Note
• https://bdu.fstec.ru/vul/2015-01426 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0258 · Security Note
• https://osv.dev/vulnerability/GHSA-q45q-5233-229p · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://web.archive.org/web/20111210005350/http://securityfocus.com/bid/33376 · Note
• http://secunia.com/advisories/33679 · Note
• http://securityfocus.com/bid/33376 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48133 · Note