CVE-2022-47406
Medium
Description
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
SeverityMedium
CVSS5.4
Exploit probability41. percentile0.5%
ProductChange Password For Frontend Users
PublishedDec 14, 2022
First seenDec 14, 2022
Weakness typeCWE-613CWE-613
How to fix
Update
- change_password_for_frontend_users_project change_password_for_frontend_users2.0.5, 3.0.3 or later
- typo3/cms2.0.5, 3.0.3 or later
- derhansen/fe_change_pwd3.0.3, 2.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| change_password_for_frontend_users_project change_password_for_frontend_users | v < 2.0.5, 3.0.0 ≤ v < 3.0.3 | 2.0.5, 3.0.3 |
| typo3/cmsPackagist | v < 2.0.5, 3.0.0 ≤ v < 3.0.3 | 2.0.5, 3.0.3 |
| derhansen/fe_change_pwdPackagist | 3.0.0 ≤ v < 3.0.3, v < 2.0.5 | 3.0.3, 2.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.