PT-2022-16034 · Typo3 · Typo3

Torben Hansen · Published 2022-12-13 · Updated 2024-03-06 · CVE-2022-23501

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 8.7.49 TYPO3 versions prior to 9.5.38 TYPO3 versions prior to 10.4.33 TYPO3 versions prior to 11.5.20 TYPO3 versions prior to 12.1.1

Description The issue concerns Improper Authentication in TYPO3, an open source PHP based web content management system. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account, however, credentials must be known to the adversary.

Recommendations Update to TYPO3 version 8.7.49 ELTS to fix the issue. Update to TYPO3 version 9.5.38 ELTS to fix the issue. Update to TYPO3 version 10.4.33 to fix the issue. Update to TYPO3 version 11.5.20 to fix the issue. Update to TYPO3 version 12.1.1 to fix the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-302

CWE-287

Related Identifiers

BIT-TYPO3-2022-23501

CVE-2022-23501

GHSA-JFP7-79G7-89RF

Affected Products

Typo3

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23501.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23501.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-23501.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2022-23501 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jfp7-79g7-89rf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23501 · Security Note
• https://osv.dev/vulnerability/BIT-typo3-2022-23501 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/28be9cdb3fed02ce4cfc6fa2d39f7d8e2266eced · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-jfp7-79g7-89rf · Note
• https://t.me/cibsecurity/54497 · Telegram Post
• https://typo3.org/security/advisory/typo3-core-sa-2022-013 · Note
• https://t.me/cvenotify/39833 · Telegram Post