PT-2022-28056

CVE-2022-47406

Published

2022-12-14

Updated

2025-04-21

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fe change pwd extension versions 2.0.5 and earlier, 3.x versions prior to 3.0.3

Description An issue was discovered in the fe change pwd extension for TYPO3, where the extension fails to revoke existing sessions for the current user when the password has been changed.

Recommendations For fe change pwd extension versions 2.0.5 and earlier, update to version 2.0.5 or later. For fe change pwd extension 3.x versions prior to 3.0.3, update to version 3.0.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Torben Hansen

Vendors

Affected products

Weakness enumeration

CWE-613: Insufficient Session Expiration

Related identifiers

CVE-2022-47406