-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing session termination after password changes. In TYPO3 frontend user management, the controller action responsible for password updates (typically updateAction) would be the logical location where session revocation should occur. The extension's failure to call session invalidation methods (like FrontendUserAuthentication::logoff() or session removal) in this workflow directly matches the described vulnerability. While no direct code diffs are available, the vulnerability pattern and TYPO3's architecture strongly indicate the password update handler as the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | < 2.0.5 | 2.0.5 |
| typo3/cms | composer | >= 3.0.0, < 3.0.3 | 3.0.3 |
| derhansen/fe_change_pwd | composer | >= 3.0.0, < 3.0.3 | 3.0.3 |
| derhansen/fe_change_pwd | composer | < 2.0.5 | 2.0.5 |
Ongoing coverage of React2Shell