TYPO3 Security Misconfiguration in Install Tool Cookie
High severity
GitHub Reviewed
Published
Jun 7, 2024
to the GitHub Advisory Database
Package
Affected versions
>= 7.0.0, < 7.6.32
>= 8.0.0, < 8.7.21
>= 9.0.0, < 9.5.2
Patched versions
7.6.32
8.7.21
9.5.2
Description
Published to the GitHub Advisory Database
Jun 7, 2024
Reviewed
Jun 7, 2024
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
References