CVE-2022-47406

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2022-016	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users::::::typo3::*
	cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users::::::typo3::*

History

19 Dec 2022, 15:35

Type	Values Removed	Values Added
CWE		CWE-613
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Change Password For Frontend Users Project change Password For Frontend Users Change Password For Frontend Users Project
CPE		cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users::::::typo3::*
References	~~(MISC) https://typo3.org/security/advisory/typo3-ext-sa-2022-016 -~~	(MISC) https://typo3.org/security/advisory/typo3-ext-sa-2022-016 - Patch, Vendor Advisory

14 Dec 2022, 21:43

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-12-14 21:15

Updated : 2023-12-10 14:48

NVD link : CVE-2022-47406

Mitre link : CVE-2022-47406

CVE.ORG link : CVE-2022-47406

JSON object : View

Products Affected

change_password_for_frontend_users_project

change_password_for_frontend_users

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2022-47406", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2022-12-14T21:15:13.710", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2022-016", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en la extensi\u00f3n fe_change_pwd (tambi\u00e9n conocida como Cambiar contrase\u00f1a para usuarios frontend) antes de 2.0.5 y 3.x antes de 3.0.3, para TYPO3. La extensi\u00f3n no puede revocar las sesiones existentes para el usuario actual cuando se cambia la contrase\u00f1a."}], "lastModified": "2022-12-19T15:35:15.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users:*:*:*:*:*:typo3:*:*", "vulnerable": true, "matchCriteriaId": "CB4F5423-BD60-4278-9683-B2DD65D0FFD0", "versionEndExcluding": "2.0.5"}, {"criteria": "cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users:*:*:*:*:*:typo3:*:*", "vulnerable": true, "matchCriteriaId": "8E88FB0D-B71C-44FD-9829-322006A6FB2E", "versionEndExcluding": "3.0.3", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}