CVE-2022-31050 json
Insufficient Session Expiration in TYPO3 Admin Tool
published 2022-06-14 4 y ago modified 2026-06-17 4 mo ago also BIT-typo3-2022-31050 , EUVD-2022-6179 , GHSA-wwjw-r3gj-39fq
- cvss
- 6.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Patch / fix
- packagist typo3/cms-core 9.5.35, 10.4.29, 11.5.11
- packagist typo3/cms 10.4.29, 11.5.11
- bitnami typo3 9.5.35, 10.4.29, 11.5.11
- typo3 typo3 9.5.35, 10.4.29, 11.5.11
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.27% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L |
| GitHub | 3.1 | 6.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| OSV | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=9.0.0, <9.5.35 >=10.0.0, <10.4.29 >=11.0.0, <11.5.11 |
9.5.35 10.4.29 11.5.11 |
| packagist | typo3/cms | >=10.0.0, <10.4.29 >=11.0.0, <11.5.11 |
10.4.29 11.5.11 |
| bitnami | typo3 | >=9.0.0, <9.5.35 >=10.0.0, <10.4.29 >=11.0.0, <11.5.11 |
9.5.35 10.4.29 11.5.11 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d
web, patch, third-party-advisory
-
typo3.org
/security/advisory/typo3-core-sa-2022-005
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-31050
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-31050.yaml
web
-
github.com
/TYPO3-CMS/core
package
Sources
- CVE List CVE-2022-31050
- GitHub Advisory GHSA-wwjw-r3gj-39fq
- NVD CVE-2022-31050
- OSV BIT-typo3-2022-31050
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.