Overview
- Description
- An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
Weaknesses
- nvd@nist.gov
- CWE-613
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users:*:*:*:*:*:typo3:*:*",
"vulnerable": true,
"matchCriteriaId": "CB4F5423-BD60-4278-9683-B2DD65D0FFD0",
"versionEndExcluding": "2.0.5"
},
{
"criteria": "cpe:2.3:a:change_password_for_frontend_users_project:change_password_for_frontend_users:*:*:*:*:*:typo3:*:*",
"vulnerable": true,
"matchCriteriaId": "8E88FB0D-B71C-44FD-9829-322006A6FB2E",
"versionEndExcluding": "3.0.3",
"versionStartIncluding": "3.0.0"
}
],
"operator": "OR"
}
]
}
]