CVE-2022-47406
Last modified
CVE-2022-47406 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Change Password For Frontend Users Project | Change Password For Frontend Users | < 2.0.5 |
| Change Password For Frontend Users Project | Change Password For Frontend Users | >= 3.0.0, < 3.0.3 |
References
- https://typo3.org/security/advisory/typo3-ext-sa-2022-016Patch, Vendor Advisory
- https://typo3.org/security/advisory/typo3-ext-sa-2022-016Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-47406?
How severe is CVE-2022-47406?
How do I fix CVE-2022-47406?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-47400Rejected reason: Not used
- CVE-2022-47401Rejected reason: Not used
- CVE-2022-47402Rejected reason: Not used
- CVE-2022-47403Rejected reason: Not used
- CVE-2022-47404Rejected reason: Not used
- CVE-2022-47405Rejected reason: Not used
- CVE-2022-47407An issue was discovered in the fp_masterquiz (aka Master-Qui…6.5
- CVE-2022-47408An issue was discovered in the fp_newsletter (aka Newsletter…9.1
- CVE-2022-47409An issue was discovered in the fp_newsletter (aka Newsletter…7.5
- CVE-2022-4741A vulnerability was found in docconv up to 1.2.0 and classif…6.5
- CVE-2022-47410An issue was discovered in the fp_newsletter (aka Newsletter…7.5
- CVE-2022-47411An issue was discovered in the fp_newsletter (aka Newsletter…7.5
Are you affected by CVE-2022-47406?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST