Lucene search
Veracode Vulnerability DatabaseVERACODE:37024HistorySep 14, 2022 - 6:53 a.m.
Improper Access Control
2022-09-1406:53:31
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
15
improper access control
vulnerable software
password reset vulnerability
0.001 Low
EPSS
Percentile
25.3%
typo3/cms is vulnerable to improper access control. The expiration time of a password reset link has never been evaluated, which allows an authenticated attacker to use the password reset link to perform a password reset even if the default expiry time of two hours has been exceeded.
References
github.com/TYPO3/typo3/commit/00b52a443b21baaaab35f8606dbb0ce427261bb5
github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a
github.com/TYPO3/typo3/commit/dffc750623bce733414b28c1f236ac0112568f2f
github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2
typo3.org/security/advisory/typo3-core-sa-2022-008
Related
cve
cve
CVE-2022-36106
2022-09-13 18:15:15
cvelist
cvelist
osv
osv
TYPO3 CMS missing check for expiration time of password reset token for backend users
2022-09-16 17:16:11
BIT-typo3-2022-36106
2024-03-06 11:08:51
CVE-2022-36106
2022-09-13 18:15:15
openvas
openvas
TYPO3 Password Reset Vulnerability (TYPO3-CORE-SA-2022-008)
2022-09-20 00:00:00
friendsofphp
friendsofphp
nvd
nvd
CVE-2022-36106
2022-09-13 18:15:15
prion
prion
Default credentials
2022-09-13 18:15:00
github
github