GHSA-q45q-5233-229p

Authentication library in TYPO3 vulnerable to session fixation

Source: GitHub Advisory Database (reviewed) High CVE-2009-0256

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	typo3/cms	>= 4.0.0, < 4.0.10	4.0.10
Packagist	typo3/cms	>= 4.1.0, < 4.1.8	4.1.8
Packagist	typo3/cms	>= 4.2.0, < 4.2.4	4.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-0256 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48133 web
https://github.com/TYPO3/typo3 package
https://web.archive.org/web/20111210005350/http://www.securityfocus.com/bid/33376 web
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001 web
http://www.debian.org/security/2009/dsa-1711 web