CVE-2022-36106

 

Published at: - 13-09-2022 08:15

Last modified: - 13-09-2022 10:43

Total changes: - 1

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://typo3.org/security/advisory/typo3-core-sa-2022-008
• https://github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2
• https://github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a

 

Keywords

NVD

 

CVE-2022-36106

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures