GHSA-r9vc-jfmh-6j48
GHSA-r9vc-jfmh-6j48 · TYPO3 frontend login vulnerable to Session Fixation
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.
CVSS 7.1 · Alta · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
typo3/cms Packagist
- Versiones
- 6.2.0
- 6.2.1
- 6.2.10
- 6.2.10-rc1
- 6.2.11
- 6.2.12
- 6.2.13
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- 6.2.6
- 6.2.7
- 6.2.8
- 6.2.9
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 6.2.0, < 6.2.14
Actualiza a 6.2.14
typo3/cms Packagist
- Versiones
- 7.0.0
- 7.0.1
- 7.0.2
- 7.1.0
- 7.2.0
- 7.3.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 7.0.0, < 7.3.1
Actualiza a 7.3.1
Fuentes originales
- https://github.com/TYPO3/typo3/commit/4c9aba94a930d56ab374693c9c5cc0458587278a
- https://github.com/TYPO3/typo3/commit/4f6e84bba3c13ea8b2652af1a4c47758aa0705f4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-2.yaml
- https://github.com/TYPO3/typo3
- https://typo3.org/security/advisory/typo3-core-sa-2015-003
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003
- https://osv.dev/vulnerability/GHSA-r9vc-jfmh-6j48