CVE-2009-0256

Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/33617	Vendor Advisory
http://secunia.com/advisories/33679
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/	Vendor Advisory
http://www.debian.org/security/2009/dsa-1711
http://www.securityfocus.com/bid/33376
https://exchange.xforce.ibmcloud.com/vulnerabilities/48133

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:typo3:typo3:4.0:::::::*
	cpe:2.3:a:typo3:typo3:4.0.1:::::::*
	cpe:2.3:a:typo3:typo3:4.0.2:::::::*
	cpe:2.3:a:typo3:typo3:4.0.3:::::::*
	cpe:2.3:a:typo3:typo3:4.0.4:::::::*
	cpe:2.3:a:typo3:typo3:4.0.5:::::::*
	cpe:2.3:a:typo3:typo3:4.0.6:::::::*
	cpe:2.3:a:typo3:typo3:4.0.7:::::::*
	cpe:2.3:a:typo3:typo3:4.0.8:::::::*
	cpe:2.3:a:typo3:typo3:4.0.9:::::::*
	cpe:2.3:a:typo3:typo3:4.1.0:::::::*
	cpe:2.3:a:typo3:typo3:4.1.0:beta1::::::
	cpe:2.3:a:typo3:typo3:4.1.0:rc1::::::
	cpe:2.3:a:typo3:typo3:4.1.1:::::::*
	cpe:2.3:a:typo3:typo3:4.1.2:::::::*
	cpe:2.3:a:typo3:typo3:4.1.3:::::::*
	cpe:2.3:a:typo3:typo3:4.1.4:::::::*
	cpe:2.3:a:typo3:typo3:4.1.5:::::::*
	cpe:2.3:a:typo3:typo3:4.1.6:::::::*
	cpe:2.3:a:typo3:typo3:4.1.7:::::::*
	cpe:2.3:a:typo3:typo3:4.2.0:::::::*
	cpe:2.3:a:typo3:typo3:4.2.1:::::::*
	cpe:2.3:a:typo3:typo3:4.2.2:::::::*
	cpe:2.3:a:typo3:typo3:4.2.3:::::::*

History

No history.

Information

Published : 2009-01-22 23:30

Updated : 2017-08-08 01:33

NVD link : CVE-2009-0256

Mitre link : CVE-2009-0256

CVE.ORG link : CVE-2009-0256

JSON object : View

Products Affected

typo3

typo3

CWE

CWE-287

Improper Authentication

{"id": "CVE-2009-0256", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-01-22T23:30:04.437", "references": [{"url": "http://secunia.com/advisories/33617", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33679", "source": "cve@mitre.org"}, {"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2009/dsa-1711", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/33376", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48133", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication."}, {"lang": "es", "value": "Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en la librer\u00eda de autenticaci\u00f3n en TYPO3 v4.0.0 a v4.0.9, v4.1.0 a v4.1.7 y v4.2.0 a v4.2.3, permite a atacantes remotos secuestrar sesiones web mediante vectores no especificados, en relaci\u00f3n con (1) el interfaz externo y (2) la autenticaci\u00f3n del interfaz interno."}], "lastModified": "2017-08-08T01:33:51.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25EAE65C-1E17-48CD-B48C-E0BC09FB6596"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "501A9157-044A-4856-8092-418D7329EED3"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EA47174-9BC4-4B74-8618-6A7B0773553B"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A13146E-EC04-4354-9123-BC7CB292C66A"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F27B173-8D10-47F7-8450-F8808A918295"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D1FAD0A-6B98-476B-BCD2-361996CA1C36"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE992D57-AF82-4BF0-96E8-98110C0AEBF3"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A9A484F-C34D-4885-8125-D9C8725EEB4E"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCCB2DE6-4407-4E40-8574-9C813183565B"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E19647A4-C422-42D0-863B-5B6E0B08BFAA"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC2F89D7-D34C-4ADD-8A9E-34C37122C3C0"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "273F2E33-0655-46DE-9397-E16658B4BD8C"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B8F7039-4117-4D53-ABE8-99C10518D351"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "161E310F-F2D8-40B3-8390-8C52ACDD0B72"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6B33D32-4D59-4768-A2C6-9DC7CD30F5E6"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4679B5DF-25FA-40E9-A322-DF1FF1BC7E7C"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D69530-AE74-4012-B522-01D0B6B01662"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5514D17F-95A5-48C5-9F91-554F8D3C3DF7"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E46E35EC-FF7B-4510-A5F2-FC230B7477B4"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.1.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A671ED2-91AA-4447-8996-A8A16FE753A8"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D93919E9-B3E8-483E-A701-D87570127207"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6B1326B-CB9E-4B40-85BD-05AF52E6A1D2"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDDEAF6A-8A99-4872-98CC-12BD54515B07"}, {"criteria": "cpe:2.3:a:typo3:typo3:4.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D8185B9-D244-43B3-9DF1-FF137A2108DD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}