CVE-2022-23502 TYPO3 contains Insufficient Session Expiration after Password Reset

2022-12-1407:34:21

CWE-613

GitHub_M

www.cve.org

typo3

session expiration

password reset

security patch

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.

CNA Affected

[
  {
    "vendor": "TYPO3",
    "product": "typo3",
    "versions": [
      {
        "version": ">= 10.0.0, < 10.4.33",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0, < 11.5.20",
        "status": "affected"
      },
      {
        "version": ">= 12.0.0, < 12.1.1",
        "status": "affected"
      }
    ]
  }
]