CRITICAL9.8

GHSA-53mm-hx32-6475

TYPO3 vulnerable to Insufficient Session Expiration

Quick fix

GHSA-53mm-hx32-6475 — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^2.0.5

Details

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms

Introduced in: 0Fixed in: 2.0.5

Fixcomposer require typo3/cms:^2.0.5

Packagist/typo3/cms

Introduced in: 3.0.0Fixed in: 3.0.3

Fixcomposer require typo3/cms:^3.0.3

Packagist/derhansen/fe_change_pwd

Introduced in: 3.0.0Fixed in: 3.0.3

Fixcomposer require derhansen/fe_change_pwd:^3.0.3

Packagist/derhansen/fe_change_pwd

Introduced in: 0Fixed in: 2.0.5

Fixcomposer require derhansen/fe_change_pwd:^2.0.5

References

https://nvd.nist.gov/vuln/detail/CVE-2022-47406[ADVISORY]
https://github.com/FriendsOfPHP/security-advisories/blob/master/derhansen/fe_change_pwd/CVE-2022-47406.yaml[WEB]
https://github.com/TYPO3/typo3[PACKAGE]
https://typo3.org/security/advisory/typo3-ext-sa-2022-016[WEB]