CVE-2022-36106 json
Missing check for expiration time of password reset token in TYPO3
published 4y ago modified 4mo ago also BIT-typo3-2022-36106 , EUVD-2022-6705 , GHSA-5959-4x58-r8c2
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
Patch / fix
- packagist typo3/cms-core 10.4.32, 11.5.16
- packagist typo3/cms 10.4.32, 11.5.16
- bitnami typo3 10.4.31, 11.5.15
- github.com/TYPO3/typo3@56af2bd commit
- github.com/TYPO3/typo3@00b52a4 commit
Is CVE-2022-36106 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=10.4.0, <10.4.32 >=11.0.0, <11.5.16 |
10.4.32 11.5.16 |
| packagist | typo3/cms | >=10.4.0, <10.4.32 >=11.0.0, <11.5.16 |
10.4.32 11.5.16 |
| bitnami | typo3 | >=10.0.0, <10.4.31 >=11.0.0, <11.5.15 |
10.4.31 11.5.15 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a
web, patch, third-party-advisory
-
github.com
/TYPO3/typo3/commit/00b52a443b21baaaab35f8606dbb0ce427261bb5
web
-
typo3.org
/security/advisory/typo3-core-sa-2022-008
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36106
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36106.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36106.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2022-36106
- GitHub Advisory GHSA-5959-4x58-r8c2
- NVD CVE-2022-36106
- OSV BIT-typo3-2022-36106
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.