CVE-2022-47406

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2022-016	Patch Vendor Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2022-016	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users::::::typo3::*
	cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users::::::typo3::*

History

21 Nov 2024, 07:31

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : 5.4
References	~~() https://typo3.org/security/advisory/typo3-ext-sa-2022-016 - Patch, Vendor Advisory~~	() https://typo3.org/security/advisory/typo3-ext-sa-2022-016 - Patch, Vendor Advisory

19 Dec 2022, 15:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-12-14 21:15

Updated : 2024-11-21 07:31

NVD link : CVE-2022-47406

Mitre link : CVE-2022-47406

CVE.ORG link : CVE-2022-47406

JSON object : View

Products Affected

change_password_for_frontend_users_project

change_password_for_frontend_users

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2022-47406", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-12-14T21:15:13.710", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2022-016", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://typo3.org/security/advisory/typo3-ext-sa-2022-016", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en la extensi\u00f3n fe_change_pwd (tambi\u00e9n conocida como Cambiar contrase\u00f1a para usuarios frontend) antes de 2.0.5 y 3.x antes de 3.0.3, para TYPO3. La extensi\u00f3n no puede revocar las sesiones existentes para el usuario actual cuando se cambia la contrase\u00f1a."}], "lastModified": "2024-11-21T07:31:53.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users:*:*:*:*:*:typo3:*:*", "vulnerable": true, "matchCriteriaId": "CB4F5423-BD60-4278-9683-B2DD65D0FFD0", "versionEndExcluding": "2.0.5"}, {"criteria": "cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users:*:*:*:*:*:typo3:*:*", "vulnerable": true, "matchCriteriaId": "8E88FB0D-B71C-44FD-9829-322006A6FB2E", "versionEndExcluding": "3.0.3", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}