-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the placement of sleep(5) in LoginController's checkRedirect() method, which was triggered only during specific login flow states. Attackers could bypass this by crafting requests that avoided the isLoginInProgress() check. The patch moved the delay to AbstractUserAuthentication::checkAuthentication() and added a hook, indicating the original implementation in LoginController was the weak point. The pre-patch code in checkRedirect() had a flawed conditional structure (shown in the diff removal of sleep(5)), making it the vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.14 | 6.2.14 |
| typo3/cms | composer | >= 7.0.0, < 7.3.1 | 7.3.1 |