CVE-2009-0256: Session Fixation Vulnerability in TYPO3 CMS
Summary
CVE-2009-0256: Authentication library in TYPO3 vulnerable to session fixation. Affects typo3/cms across 3 version ranges.
>= 4.0.0, < 4.0.10
>= 4.1.0, < 4.1.8
>= 4.2.0, < 4.2.4
Fixed in 4.0.10, 4.1.8 or 4.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities for building and maintaining web applications. However, versions 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 of TYPO3 CMS are vulnerable to a session fixation vulnerability in the authentication library.
Vulnerability Detail
The session fixation vulnerability in TYPO3 CMS allows remote attackers to hijack web sessions through unspecified vectors related to frontend and backend authentication. This vulnerability can lead to unauthorized access to sensitive information, manipulation of user accounts, and potential misuse of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.104.0.10composer require typo3/cms:4.0.10 -
>= 4.1.0, < 4.1.84.1.8composer require typo3/cms:4.1.8 -
>= 4.2.0, < 4.2.44.2.4composer require typo3/cms:4.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, TYPO3 CMS versions 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 are vulnerable to a session fixation vulnerability in the authentication library. Users should upgrade to the fixed versions to mitigate the risk of session hijacking and unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for building and managing websites.
A session fixation vulnerability allows an attacker to hijack a user's session by fixing or setting the session ID to a known value.
This vulnerability can be exploited by remote attackers through unspecified vectors related to frontend and backend authentication.
The session fixation vulnerability in TYPO3 CMS can lead to unauthorized access to sensitive information, manipulation of user accounts, and potential misuse of the affected system.
To protect your TYPO3 CMS installation, it is recommended to upgrade to the fixed versions: 4.0.10, 4.1.8, or 4.2.4, depending on the installed version.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
