CVE-2022-23502CWE-613

TYPO3 contains Insufficient Session Expiration after Password Reset

Medium · published December 14, 2022

CVSS v3.1
5.4
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2022-12-14T07:34Z
EPSS history
Timeline
  • 14 DEC 07:34Z
    TYPO3 contains Insufficient Session Expiration after Password Reset
    cvelistv5