CVE-2022-23502

2022-12-1400:00:00

ubuntu.com

typo3

php

password recovery

session revocation

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

TYPO3 is an open source PHP based web content management system. In
versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their
password using the corresponding password recovery functionality, existing
sessions for that particular user account were not revoked. This applied to
both frontend user sessions and backend user sessions. This issue is
patched in versions 10.4.33, 11.5.20, 12.1.1.