{"id":"GHSA-53mm-hx32-6475","summary":"TYPO3 vulnerable to Insufficient Session Expiration","details":"An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.","aliases":["CVE-2022-47406"],"modified":"2023-11-08T04:11:00.109197Z","published":"2022-12-14T21:30:16Z","database_specific":{"github_reviewed_at":"2022-12-19T21:10:07Z","nvd_published_at":"2022-12-14T21:15:00Z","cwe_ids":["CWE-613"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47406"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/derhansen/fe_change_pwd/CVE-2022-47406.yaml"},{"type":"PACKAGE","url":"https://github.com/TYPO3/typo3"},{"type":"WEB","url":"https://typo3.org/security/advisory/typo3-ext-sa-2022-016"}],"affected":[{"package":{"name":"typo3/cms","ecosystem":"Packagist","purl":"pkg:composer/typo3/cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-53mm-hx32-6475/GHSA-53mm-hx32-6475.json"}},{"package":{"name":"typo3/cms","ecosystem":"Packagist","purl":"pkg:composer/typo3/cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-53mm-hx32-6475/GHSA-53mm-hx32-6475.json"}},{"package":{"name":"derhansen/fe_change_pwd","ecosystem":"Packagist","purl":"pkg:composer/derhansen/fe_change_pwd"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}],"versions":["3.0.0","3.0.1","3.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-53mm-hx32-6475/GHSA-53mm-hx32-6475.json"}},{"package":{"name":"derhansen/fe_change_pwd","ecosystem":"Packagist","purl":"pkg:composer/derhansen/fe_change_pwd"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-53mm-hx32-6475/GHSA-53mm-hx32-6475.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}