PT-2022-23195 · Typo3 · Typo3

Published 2022-09-13 · Updated 2024-03-06 · CVE-2022-36105

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 7.6.58 ELTS TYPO3 versions prior to 8.7.48 ELTS TYPO3 versions prior to 9.5.37 ELTS TYPO3 versions prior to 10.4.32 TYPO3 versions prior to 11.5.16

Description It has been discovered that observing response time during user authentication can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by this problem. Affected extensions must implement new MimicServiceInterface::mimicAuthUser, which simulates corresponding times regular processing would usually take.

Recommendations Update to TYPO3 version 7.6.58 ELTS to fix this problem. Update to TYPO3 version 8.7.48 ELTS to fix this problem. Update to TYPO3 version 9.5.37 ELTS to fix this problem. Update to TYPO3 version 10.4.32 to fix this problem. Update to TYPO3 version 11.5.16 to fix this problem. As a temporary workaround, consider implementing the MimicServiceInterface::mimicAuthUser in affected extensions to simulate corresponding times regular processing would usually take.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BIT-TYPO3-2022-36105

CVE-2022-36105

GHSA-M392-235J-9R7R

Affected Products

Typo3

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36105.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36105.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36105.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/f8b83ce15d4ea275a5a5e564e5d324242f7937b6 · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2022-007 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2022-36105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36105 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36105 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m392-235j-9r7r · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-m392-235j-9r7r · Note
• https://github.com/TYPO3/typo3/commit/f0fc9c4cd7c38207c30dd158de53ee5d9d6f41a2 · Note