CVE-2022-36105: User Enumeration via Response Timing in TYPO3
First published: Tue Sep 13 2022(Updated: )
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=10.0.0<10.4.32>=11.0.0<11.5.16 | |
| composer/typo3/cms-core | >=10.0.0<10.4.32>=11.0.0<11.5.16 | |
| Typo3 Typo3 | >=7.0.0<=7.6.57 | |
| Typo3 Typo3 | >=8.0.0<=8.7.47 | |
| Typo3 Typo3 | >=9.0.0<=9.5.36 | |
| Typo3 Typo3 | >=10.0.0<=10.4.31 | |
| Typo3 Typo3 | >=11.0.0<=11.5.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-36105?
CVE-2022-36105 is a vulnerability in TYPO3 that allows an attacker to distinguish between existing and non-existing user accounts by observing response time during user authentication.
What is the severity of CVE-2022-36105?
The severity of CVE-2022-36105 is medium with a CVSS score of 5.3.
How does CVE-2022-36105 affect TYPO3?
CVE-2022-36105 affects TYPO3 versions 10.0.0 to 10.4.32, 11.0.0 to 11.5.16, and other versions mentioned in the advisory.
How can I fix CVE-2022-36105?
To fix CVE-2022-36105, upgrade TYPO3 to a version that is not affected by the vulnerability, as mentioned in the advisory.
Where can I find more information about CVE-2022-36105?
You can find more information about CVE-2022-36105 in the TYPO3 security advisory TYPO3-CORE-SA-2022-007 and the related GitHub links.
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/title
- agent/references
- agent/event
- agent/description
- agent/tags
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/7.0.0
- version/typo3 typo3/7.6.57
- version/typo3 typo3/8.0.0
- version/typo3 typo3/8.7.47
- version/typo3 typo3/9.0.0
- version/typo3 typo3/9.5.36
- version/typo3 typo3/10.0.0
- version/typo3 typo3/10.4.31
- version/typo3 typo3/11.0.0
- version/typo3 typo3/11.5.15