CVE-2022-36105: User Enumeration via Response Timing in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new MimicServiceInterface::mimicAuthUser, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue.
Other sources
TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-36105?
CVE-2022-36105 is a vulnerability in TYPO3 that allows an attacker to distinguish between existing and non-existing user accounts by observing response time during user authentication.
What is the severity of CVE-2022-36105?
The severity of CVE-2022-36105 is medium with a CVSS score of 5.3.
How does CVE-2022-36105 affect TYPO3?
CVE-2022-36105 affects TYPO3 versions 10.0.0 to 10.4.32, 11.0.0 to 11.5.16, and other versions mentioned in the advisory.
How can I fix CVE-2022-36105?
To fix CVE-2022-36105, upgrade TYPO3 to a version that is not affected by the vulnerability, as mentioned in the advisory.
Where can I find more information about CVE-2022-36105?
You can find more information about CVE-2022-36105 in the TYPO3 security advisory TYPO3-CORE-SA-2022-007 and the related GitHub links.