CVE-2022-31050CWE-613

Insufficient Session Expiration in TYPO3 Admin Tool

Medium · published June 14, 2022

CVSS v3.1
6.0
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01255 · 69.3th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2022-06-14T20:55Z
EPSS history
Timeline
  • 14 JUN 20:55Z
    Insufficient Session Expiration in TYPO3 Admin Tool
    cvelistv5