~ / search / GHSA-954j-f27r-cj52

GHSA-954j-f27r-cj52

Cleartext storage of session identifier

Source: GitHub Advisory Database (reviewed) High CVE-2020-26228

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms-core >= 9.0.0, < 9.5.23 9.5.23
Packagist typo3/cms-core >= 10.0.0, < 10.4.10 10.4.10
Packagist typo3/cms-core >= 8.7.0, < 8.7.38 8.7.38
Packagist typo3/cms >= 10.0.0, < 10.4.10 10.4.10
Packagist typo3/cms >= 9.0.0, < 9.5.23 9.5.23
Packagist typo3/cms >= 8.7.0, < 8.7.38 8.7.38

Details

As written in the advisory (Markdown source, shown as plain text).

User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. ### Solution Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described. ### Credits Thanks to TYPO3 security team member Helmut Hummel who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader as well as TYPO3 contributor Markus Klein who fixed the issue.

References

External links from the advisory. They lead to third-party sites.