GHSA-r9vc-jfmh-6j48: TYPO3 frontend login vulnerable to Session Fixation
It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-2.yaml
- github.com/TYPO3/typo3
- github.com/TYPO3/typo3/commit/4c9aba94a930d56ab374693c9c5cc0458587278a
- github.com/TYPO3/typo3/commit/4f6e84bba3c13ea8b2652af1a4c47758aa0705f4
- github.com/advisories/GHSA-r9vc-jfmh-6j48
- typo3.org/security/advisory/typo3-core-sa-2015-003
- typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003
Code Behaviors & Features
Detect and mitigate GHSA-r9vc-jfmh-6j48 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →