TYPO3 Security Misconfiguration in User Session Handling · GHSA-xmgr-jff3-fcfv · GitHub Advisory Database · GitHub

TYPO3 Security Misconfiguration in User Session Handling

Moderate severity GitHub Reviewed Published May 30, 2024 to the GitHub Advisory Database

Package

typo3/cms-core (Composer)

Affected versions

>= 8.0.0, < 8.7.25

>= 9.0.0, < 9.5.6

Patched versions

8.7.25

9.5.6

Description

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability.

References

Published to the GitHub Advisory Database May 30, 2024

Reviewed May 30, 2024

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N