PT-2024-40263 · Packagist · Typo3/Cms

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned.

Description: A security issue has been found where cookies created in the Install Tool are not properly secured to only be submitted via HTTP. This, combined with other issues like cross-site scripting, can lead to the hijacking of an active and valid session in the Install Tool.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1004

Related Identifiers

GHSA-F777-F784-36GM

Affected Products

Typo3/Cms

References · 7

• https://osv.dev/vulnerability/GHSA-f777-f784-36gm · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-4.yaml · Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/a5359491e3fb3164a6ba96a66c8e67fbb9971a4c · Note
• https://github.com/TYPO3/typo3/commit/13328b0f74ac589a20b021db814dfa672581c26a · Note
• https://github.com/TYPO3/typo3/commit/918e50e4d20d88c7e40ad3bb134267d07706b0b1 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2018-009 · Note