CVE-2023-47127

· MEDIUMModified

← All CVEs

CVSS v3.1

4.2

EPSS

0.56%

Published

Nov 14, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-302CWE-287

Affected Products (5)

typo3 · typo3 (up to 8.7.55)vulnerable

typo3 · typo3 (up to 9.5.44)vulnerable

typo3 · typo3 (up to 10.4.41)vulnerable

typo3 · typo3 (up to 11.5.33)vulnerable

typo3 · typo3 (up to 12.4.8)vulnerable

References (6)

https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019