Read the docs
TI-2024-38842 Aliases GHSA-r9vc-jfmh-6j48

TYPO3 frontend login vulnerable to Session Fixation

Priority LOW 38CWE-384Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Spoofing
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-384.

Summary

It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.

Why it matters now

Fix Fixed typo3/cms (Packagist): 6.2.14, 7.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—typo3/cms (Packagist)6.2.0 to before 6.2.146.2.14Patch availableGHSA-r9vc-jfmh-6j48
—typo3/cms (Packagist)7.0.0 to before 7.3.17.3.1Patch availableGHSA-r9vc-jfmh-6j48
  • typo3/cms (Packagist) Vendor— Affected 6.2.0 to before 6.2.14 Fixed in 6.2.14 Patch available GHSA-r9vc-jfmh-6j48
  • typo3/cms (Packagist) Vendor— Affected 7.0.0 to before 7.3.1 Fixed in 7.3.1 Patch available GHSA-r9vc-jfmh-6j48

Remediation

  • Fix · GHSA-r9vc-jfmh-6j48 typo3/cms (Packagist) Fixed in 6.2.14 Advisory →
  • Fix · GHSA-r9vc-jfmh-6j48 typo3/cms (Packagist) Fixed in 7.3.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-r9vc-jfmh-6j48

References

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences