CVE-2022-47406 json
TYPO3 vulnerable to Insufficient Session Expiration
published 2022-12-14 3 y ago modified 2026-06-17 4 mo ago also GHSA-53mm-hx32-6475 , EUVD-2022-7512
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
Patch / fix
- packagist typo3/cms 2.0.5, 3.0.3
- packagist derhansen/fe_change_pwd 2.0.5, 3.0.3
- change_password_for_frontend_users_project change_password_for_frontend_users 2.0.5, 3.0.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms | <2.0.5 >=3.0.0, <3.0.3 |
2.0.5 3.0.3 |
| packagist | derhansen/fe_change_pwd | >=3.0.0, <3.0.3 <2.0.5 |
3.0.3 2.0.5 |
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
Sources
- CVE List CVE-2022-47406
- GitHub Advisory GHSA-53mm-hx32-6475
- NVD CVE-2022-47406
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.