Description
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.
Published: 2022-12-14
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-7688 TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.
Github GHSA Github GHSA GHSA-mgj2-q8wp-29rr TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset
History

Mon, 21 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Typo3 Typo3
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-04-21T18:47:37.345Z

Reserved: 2022-01-19T21:23:53.770Z

Link: CVE-2022-23502

cve-icon Vulnrichment

Updated: 2024-08-03T03:43:46.456Z

cve-icon NVD

Status : Modified

Published: 2022-12-14T08:15:10.590

Modified: 2024-11-21T06:48:41.900

Link: CVE-2022-23502

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses