Skip to content

Typo3 Security Misconfiguration in User Session Handling

Moderate severity GitHub Reviewed Published Jun 5, 2024 to the GitHub Advisory Database • Updated Jun 5, 2024

Package

composer typo3/cms (Composer)

Affected versions

>= 8.0.0, < 8.7.25
>= 9.0.0, < 9.5.6

Patched versions

8.7.25
9.5.6

Description

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability.

References

Published to the GitHub Advisory Database Jun 5, 2024
Reviewed Jun 5, 2024
Last updated Jun 5, 2024

Severity

Moderate

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-g9rv-6g56-65h8

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.