GHSA-9j8h-xrgj-7gw2medium
TYPO3 Improper Session Invalidation
Impact
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
typo3/cms Packagist
| Affected range | Recorded fix |
|---|---|
| From 6.2.0 before 6.2.3Ecosystem versions | 6.2.3 |
Version evidence: OSV · GHSA-9j8h-xrgj-7gw2
View original version evidence (3 explicit versions)
Original source description
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2014-3944
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3944.yaml
- Source reference github.com/TYPO3/typo3
- Security advisory typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001
- Security advisory typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001
- Security advisory www.debian.org/security/2014/dsa-2942
- Security advisory www.openwall.com/lists/oss-security/2014/06/03/2