MEDIUM

GHSA-9j8h-xrgj-7gw2

TYPO3 Improper Session Invalidation

Quick fix

GHSA-9j8h-xrgj-7gw2 — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^6.2.3

Details

The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms

Introduced in: 6.2.0Fixed in: 6.2.3

Fixcomposer require typo3/cms:^6.2.3

References

https://nvd.nist.gov/vuln/detail/CVE-2014-3944[ADVISORY]
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3944.yaml[WEB]
https://github.com/TYPO3/typo3[PACKAGE]
https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001[WEB]
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001[WEB]
http://www.debian.org/security/2014/dsa-2942[WEB]
http://www.openwall.com/lists/oss-security/2014/06/03/2[WEB]