PT-2022-16035 · Typo3 · Typo3

Torben Hansen · Published 2022-12-13 · Updated 2024-03-06 · CVE-2022-23502

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 10.4.33 TYPO3 versions prior to 11.5.20 TYPO3 versions prior to 12.1.1

Description The issue concerns the password recovery functionality in TYPO3, an open source PHP based web content management system. When users reset their password, existing sessions for that particular user account were not revoked, affecting both frontend and backend user sessions.

Recommendations Update to version 10.4.33 to resolve the issue. Update to version 11.5.20 to resolve the issue. Update to version 12.1.1 to resolve the issue.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BIT-TYPO3-2022-23502

CVE-2022-23502

GHSA-MGJ2-Q8WP-29RR

Affected Products

Typo3

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23502.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-23502.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23502.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23502 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23502 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2022-23502 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mgj2-q8wp-29rr · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-mgj2-q8wp-29rr · Note
• https://github.com/TYPO3/typo3/commit/d9ffbf24fcc62068033ebb3912538347bd380a6c · Note
• https://t.me/cvenotify/39832 · Telegram Post
• https://typo3.org/security/advisory/typo3-core-sa-2022-014 · Note