CVE-2022-36106

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.

How to fix CVE-2022-36106

To remediate CVE-2022-36106, upgrade the affected package to a fixed version below.

• —upgrade to 10.4.31 or later
• —upgrade to 10.4.32 or later
• —upgrade to 10.4.32 or later

Is CVE-2022-36106 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• >= 10.0.0, < 10.4.31, >= 11.0.0, < 11.5.15
• >= 10.4.0, < 10.4.32
• >= 10.4.0, < 10.4.32

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-36106
• PATCHgithub.com/TYPO3/typo3
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36106.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36106.yaml