CVE-2022-36106 json
Missing check for expiration time of password reset token in TYPO3
published 2022-09-13 4 y ago modified 2026-06-17 4 mo ago also BIT-typo3-2022-36106 , EUVD-2022-6705 , GHSA-5959-4x58-r8c2
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
Patch / fix
- packagist typo3/cms-core 10.4.32, 11.5.16
- packagist typo3/cms 10.4.32, 11.5.16
- bitnami typo3 10.4.31, 11.5.15
- github.com/TYPO3/typo3@56af2bd commit
- github.com/TYPO3/typo3@00b52a4 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=10.4.0, <10.4.32 >=11.0.0, <11.5.16 |
10.4.32 11.5.16 |
| packagist | typo3/cms | >=10.4.0, <10.4.32 >=11.0.0, <11.5.16 |
10.4.32 11.5.16 |
| bitnami | typo3 | >=10.0.0, <10.4.31 >=11.0.0, <11.5.15 |
10.4.31 11.5.15 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159a
web, patch, third-party-advisory
-
github.com
/TYPO3/typo3/commit/00b52a443b21baaaab35f8606dbb0ce427261bb5
web
-
typo3.org
/security/advisory/typo3-core-sa-2022-008
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36106
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36106.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36106.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2022-36106
- GitHub Advisory GHSA-5959-4x58-r8c2
- NVD CVE-2022-36106
- OSV BIT-typo3-2022-36106
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.