Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-36106

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

Published

2022-09-13T18:15:15.130

Last Modified

2024-11-21T07:12:24.150

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses

Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	typo3	typo3	≤ 10.4.31	Yes
Application	typo3	typo3	≤ 11.5.15	Yes

References

https://github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a Patch, Third Party Advisory ([email protected])
https://github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2 Third Party Advisory ([email protected])
https://typo3.org/security/advisory/typo3-core-sa-2022-008 Vendor Advisory ([email protected])
https://github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://typo3.org/security/advisory/typo3-core-sa-2022-008 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)