Security Misconfiguration in Typo3 CMS Frontend Session Handling
Summary
GHSA-qr5f-6fcv-w69q: Typo3 Security Misconfiguration in Frontend Session Handling. Affects typo3/cms across 2 version ranges.
>= 8.0.0, < 8.7.27
>= 9.0.0, < 9.5.8
Fixed in 8.7.27 or 9.5.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3 CMS is an open-source content management system that allows users to create and manage websites. It provides a range of features and functionalities for website development, including frontend session handling. This vulnerability specifically affects the session handling mechanism in the frontend of Typo3 CMS.
Vulnerability Detail
The vulnerability in Typo3 CMS frontend session handling allows session data of authenticated and logged-in users to be retained and transformed into an anonymous user session during the logout process. This means that the next user utilizing the same client application can gain access to the previous user's session data. This security misconfiguration can lead to unauthorized access to sensitive information and potential misuse of user accounts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.278.7.27composer require typo3/cms:8.7.27 -
>= 9.0.0, < 9.5.89.5.8composer require typo3/cms:9.5.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the fixed versions of Typo3 CMS.
Conclusion
The security misconfiguration in Typo3 CMS frontend session handling can lead to unauthorized access to user session data. It is crucial to apply the recommended fix and upgrade to the fixed versions of Typo3 CMS to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Typo3 CMS is an open-source content management system used for creating and managing websites.
This vulnerability allows unauthorized access to session data of authenticated users, potentially leading to misuse of user accounts and unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Typo3 CMS as mentioned in the 'how_to_fix' section.
No, only specific versions of Typo3 CMS are affected. Please refer to the 'affected' section for the impacted versions and their fixed counterparts.
No specific workaround is mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the fixed versions of Typo3 CMS.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
