MediumGHSA-jfp7-79g7-89rfBIT-typo3-2022-23501CVE-2022-23501
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
Published 13 Dec 2022 · Updated 6 Dec 2023
Affected packages
typo3/cms-coreComposer
- Affected
- <8.7.49
- Fixed in
- 8.7.49
Update to the fixed version for your release line, for example:
composer require typo3/cms-core:^8.7.49typo3/cms-coreComposer
- Affected
- >=9.0.0 <9.5.38
- Fixed in
- 9.5.38
Update to the fixed version for your release line, for example:
composer require typo3/cms-core:^9.5.38typo3/cms-coreComposer
- Affected
- >=10.0.0 <10.4.33
- Fixed in
- 10.4.33
Update to the fixed version for your release line, for example:
composer require typo3/cms-core:^10.4.33typo3/cms-coreComposer
- Affected
- >=11.0.0 <11.5.20
- Fixed in
- 11.5.20
Update to the fixed version for your release line, for example:
composer require typo3/cms-core:^11.5.20typo3/cms-coreComposer
- Affected
- >=12.0.0 <12.1.1
- Fixed in
- 12.1.1
Update to the fixed version for your release line, for example:
composer require typo3/cms-core:^12.1.1typo3/cmsComposer
- Affected
- >=10.0.0 <10.4.33
- Fixed in
- 10.4.33
Update to the fixed version for your release line, for example:
composer require typo3/cms:^10.4.33typo3/cmsComposer
- Affected
- >=11.0.0 <11.5.20
- Fixed in
- 11.5.20
Update to the fixed version for your release line, for example:
composer require typo3/cms:^11.5.20typo3/cmsComposer
- Affected
- >=12.0.0 <12.1.1
- Fixed in
- 12.1.1
Update to the fixed version for your release line, for example:
composer require typo3/cms:^12.1.1Details
Problem
Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary.
Solution
Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.
References
Is GHSA-jfp7-79g7-89rf in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/cms-core, and gives you the command that fixes it.
References
- Linkgithub.com/TYPO3/typo3/security/advisories/GHSA-jfp7-79g7-89rf
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-23501
- Linkgithub.com/TYPO3/typo3/commit/28be9cdb3fed02ce4cfc6fa2d39f7d8e2266eced
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-23501.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23501.yaml
- Packagegithub.com/TYPO3/typo3
- Linktypo3.org/security/advisory/typo3-core-sa-2022-013
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.