Skip to main content

Insufficient Session Expiration

CVE-2022-31050

High
7.2/10

Summary

TYPO3 is an open-source web content management system. Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. This issue affects typo3/cms 10.x through 10.4.28, and 11.x through 11.5.10; typo3/cms-core 9.x through 9.5.31, 10.x through 10.4.28, and 11.x through 11.5.10.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-613 - Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References

Advisory Timeline

  • Published