CVE-2022-31050: Insufficient Session Expiration in TYPO3 Admin Tool
First published: Tue Jun 14 2022(Updated: )
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=10.0.0<10.4.29>=11.0.0<11.5.11 | |
| composer/typo3/cms-core | >=10.0.0<10.4.29>=11.0.0<11.5.11 | |
| Typo3 Typo3 | >=9.0.0<9.5.35 | |
| Typo3 Typo3 | >=10.0.0<10.4.29 | |
| Typo3 Typo3 | >=11.0.0<11.5.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is TYPO3-CORE-SA-2022-005?
TYPO3-CORE-SA-2022-005 is a vulnerability in the TYPO3 web content management system that allows Admin Tool sessions to remain active even if the user's account permissions or access are reduced or disabled.
Which versions of TYPO3 are affected by TYPO3-CORE-SA-2022-005?
Versions 10.0.0 to 10.4.29 and Versions 11.0.0 to 11.5.11 of TYPO3 are affected by TYPO3-CORE-SA-2022-005.
What is the severity of TYPO3-CORE-SA-2022-005?
The severity of TYPO3-CORE-SA-2022-005 is rated as high with a severity score of 7.2.
How can I fix TYPO3-CORE-SA-2022-005?
To fix TYPO3-CORE-SA-2022-005, you should update your TYPO3 installation to version 9.5.34 ELTS, 10.4.29, or 11.5.11 which have addressed the vulnerability.
Where can I find more information about TYPO3-CORE-SA-2022-005?
You can find more information about TYPO3-CORE-SA-2022-005 at the TYPO3 official website advisory page: https://typo3.org/security/advisory/typo3-core-sa-2022-005, and the GitHub commit and advisory pages: https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d, https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq.
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/title
- agent/description
- agent/event
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/9.0.0
- version/typo3 typo3/10.0.0
- version/typo3 typo3/11.0.0