Miggo Logo

CVE-2010-1022:
TYPO3 Authentication Bypass via Salted user password hashes extension

7.5

CVSS Score

Basic Information

EPSS Score
-
Published
5/2/2022
Updated
2/14/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Package NameEcosystemVulnerable VersionsFirst Patched Version
typo3/cms-saltedpasswordscomposer< 0.2.130.2.13

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The advisory was withdrawn due to incorrect package identification (typo3/cms-saltedpasswords vs. t3sec_saltedpw). No code diffs, patch details, or specific technical descriptions of the exploit vectors are provided in the available sources. The vulnerability description mentions 'unspecified vectors,' and the lack of concrete implementation details makes it impossible to confidently identify specific vulnerable functions. The withdrawal of the advisory further reduces confidence in the accuracy of the original package attribution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Wit**r*wn: `typo*/*ms-s*lt**p*sswor*s` is not t** *orr**t p**k***. S**: *ttps://*it*u*.*om/*it*u*/**visory-**t***s*/pull/**** T** TYPO* S**urity - S*lt** us*r p*sswor* **s**s (t*s**_s*lt**pw) *xt*nsion ***or* *.*.** *or TYPO* *llows r*mot* *tt**k*rs

Reasoning

T** **visory w*s wit**r*wn *u* to in*orr**t p**k*** i**nti*i**tion (typo*/*ms-s*lt**p*sswor*s vs. t*s**_s*lt**pw). No *o** *i**s, p*t** **t*ils, or sp**i*i* t***ni**l **s*riptions o* t** *xploit v**tors *r* provi*** in t** *v*il**l* sour**s. T** vuln