CriticalGHSA-53mm-hx32-6475CVE-2022-47406
TYPO3 vulnerable to Insufficient Session Expiration
Published 14 Dec 2022 · Updated 8 Nov 2023
Affected packages
typo3/cmsComposer
- Affected
- <2.0.5
- Fixed in
- 2.0.5
Update to the fixed version for your release line, for example:
composer require typo3/cms:^2.0.5typo3/cmsComposer
- Affected
- >=3.0.0 <3.0.3
- Fixed in
- 3.0.3
Update to the fixed version for your release line, for example:
composer require typo3/cms:^3.0.3derhansen/fe_change_pwdComposer
- Affected
- >=3.0.0 <3.0.3
- Fixed in
- 3.0.3
Update to the fixed version for your release line, for example:
composer require derhansen/fe_change_pwd:^3.0.3derhansen/fe_change_pwdComposer
- Affected
- <2.0.5
- Fixed in
- 2.0.5
Update to the fixed version for your release line, for example:
composer require derhansen/fe_change_pwd:^2.0.5Details
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
Is GHSA-53mm-hx32-6475 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/cms, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.