CVE-2022-31050mediumCWE-613

CVE-2022-31050: falha de média gravidade em typo3

Insufficient Session Expiration in TYPO3 Admin Tool

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar typo3+ Monitorar typo3/cms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6epss 1.3%
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
TYPO3 · typo3
CVEs relacionadas — typo3

No mesmo produto, das mais perigosas para as menos.

CVE-2022-36104MEDIUMDenial of Service via Page Error Handling in TYPO3/cmsEPSS 1.6%CVE-2022-36105MEDIUMUser Enumeration via Response Timing in TYPO3EPSS 1.3%CVE-2021-41114MEDIUMHTTP Host Header Injection in Request Handling in Typo3EPSS 1.2%CVE-2022-31047MEDIUMInsertion of Sensitive Information into Log File in typo3/cms-coreEPSS 1.1%CVE-2023-38499LOWtypo3/cms-core Information Disclosure due to Out-of-scope Site ResolutionEPSS 1.1%CVE-2022-36106MEDIUMMissing check for expiration time of password reset token in TYPO3EPSS 0.9%