PT-2022-28056 · Typo3 · Fe Change Pwd

Torben Hansen · Published 2022-12-14 · Updated 2025-04-21 · CVE-2022-47406

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fe change pwd extension versions 2.0.5 and earlier, 3.x versions prior to 3.0.3

Description An issue was discovered in the fe change pwd extension for TYPO3, where the extension fails to revoke existing sessions for the current user when the password has been changed.

Recommendations For fe change pwd extension versions 2.0.5 and earlier, update to version 2.0.5 or later. For fe change pwd extension 3.x versions prior to 3.0.3, update to version 3.0.3 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-47406

GHSA-53MM-HX32-6475

Affected Products

Fe Change Pwd

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/derhansen/fe_change_pwd/CVE-2022-47406.yaml · Exploit
• https://typo3.org/security/advisory/typo3-ext-sa-2022-016 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-53mm-hx32-6475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47406 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47406 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://t.me/cvenotify/39907 · Telegram Post
• https://t.me/cibsecurity/54567 · Telegram Post
• https://t.me/cvenotify/119229 · Telegram Post
• https://t.me/cvenotify/40180 · Telegram Post