-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.14 | 6.2.14 |
| typo3/cms | composer | >= 7.0.0, < 7.3.1 | 7.3.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the authentication flow not regenerating session IDs when transitioning from anonymous to authenticated state. The patch adds session regeneration logic in checkAuthentication() through a new regenerateSessionId() call. The original vulnerable versions lacked this critical session ID rotation during authentication when an anonymous session already existed, making checkAuthentication() the root cause location. The function's failure to invalidate the initial session ID created the fixation vulnerability.
Ongoing coverage of React2Shell