VulnerabilityModified
CVE-2014-3944
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
MEDIUM 5.8EPSS 1.31%
Does this matter?
Lower severity and a low EPSS score (1.31%). Track it; it rarely justifies an emergency change on its own.
Description
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- typo3/typo3
- Source
- cve@mitre.org
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/Vendor Advisory
- http://www.debian.org/security/2014/dsa-2942
- http://www.openwall.com/lists/oss-security/2014/06/03/2
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/Vendor Advisory
- http://www.debian.org/security/2014/dsa-2942
- http://www.openwall.com/lists/oss-security/2014/06/03/2
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.