-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key functions: 1) TypoScriptFrontendController::initFEuser processes the 'recs' parameter without the enableRecordRegistration guard (pre-patch), allowing arbitrary session data injection. 2) FrontendUserAuthentication::record_registration executes the actual session storage without proper validation of anonymous sessions or resource limits. The patch added a configuration toggle around the recs processing in initFEuser, indicating this was the unprotected entry point. The record_registration method's lack of inherent throttling/validation makes it a secondary vulnerable component when abused through this vector.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 7.0.0, < 7.6.32 | 7.6.32 |
| typo3/cms | composer | >= 8.0.0, < 8.7.21 | 8.7.21 |
Ongoing coverage of React2Shell