GHSA-r9vc-jfmh-6j48
GHSA-r9vc-jfmh-6j48 · TYPO3 frontend login vulnerable to Session Fixation
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.
CVSS 7.1 · Hoch · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
typo3/cms Packagist
- Softwareversionen
- 6.2.0
- 6.2.1
- 6.2.10
- 6.2.10-rc1
- 6.2.11
- 6.2.12
- 6.2.13
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- 6.2.6
- 6.2.7
- 6.2.8
- 6.2.9
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 6.2.0, < 6.2.14
Auf 6.2.14 aktualisieren
typo3/cms Packagist
- Softwareversionen
- 7.0.0
- 7.0.1
- 7.0.2
- 7.1.0
- 7.2.0
- 7.3.0
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 7.0.0, < 7.3.1
Auf 7.3.1 aktualisieren
Originalquellen
- https://github.com/TYPO3/typo3/commit/4c9aba94a930d56ab374693c9c5cc0458587278a
- https://github.com/TYPO3/typo3/commit/4f6e84bba3c13ea8b2652af1a4c47758aa0705f4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-2.yaml
- https://github.com/TYPO3/typo3
- https://typo3.org/security/advisory/typo3-core-sa-2015-003
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003
- https://osv.dev/vulnerability/GHSA-r9vc-jfmh-6j48