CVE-2022-31050

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
TYPO3	typo3	>= 9.0.0, < 9.5.34; >= 10.0.0, < 10.4.29; >= 11.0.0, < 11.5.11

References

https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4dPatch, Third Party Advisory
https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fqThird Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2022-005Vendor Advisory
https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4dPatch, Third Party Advisory
https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fqThird Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2022-005Vendor Advisory

Timeline

Published: Jun 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310517.5semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that wo CVE-2022-310526.5Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages CVE-2022-310539.8Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnera CVE-2022-310547.5Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make us CVE-2022-310557.5kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-range CVE-2022-310569.8GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2022-310575.4Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticat CVE-2022-310587.2Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tulea CVE-2022-310595.4Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event CVE-2022-31065.5An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the CVE-2022-310605.3Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `CVE-2022-310619.8GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.