CVE-2022-36106
published 2022-09-13CVE-2022-36106: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.73%
49.8th percentile
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | argoproj_argo-cd | >= 0.11.0 < 2.9.17 | 2.9.17 |
| github.com | argoproj_argo-cd | >= 2.10.0 < 2.10.12 | 2.10.12 |
| github.com | argoproj_argo-cd | >= 2.11.0 < 2.11.3 | 2.11.3 |
| typo3 | cms | >= 10.4.0 < 10.4.32 | 10.4.32 |
| typo3 | cms | >= 11.0.0 < 11.5.16 | 11.5.16 |
| typo3 | cms-core | >= 10.4.0 < 10.4.32 | 10.4.32 |
| typo3 | cms-core | >= 11.0.0 < 11.5.16 | 11.5.16 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | 10.0.0 – 10.4.31 | — |
| typo3 | typo3 | 11.0.0 – 11.5.15 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Argo-cd authenticated users can enumerate clusters by name
ghsa·2024-06-06
CVE-2024-36106 [MEDIUM] CWE-209 Argo-cd authenticated users can enumerate clusters by name
Argo-cd authenticated users can enumerate clusters by name
### Impact
It’s possible for authenticated users to enumerate clusters by name by inspecting error messages:
```
$ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H "Authorization:
Bearer $token"
{"error":"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z","code":7,"message":"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z"}⏎
$ curl -k 'https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name' -H "Authorizati
on: Bearer $token"
{"error":"permission denied","code":7,"message":"permission denied"}
```
It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters.
```
curl -k 'https://loc
OSV
TYPO3 CMS missing check for expiration time of password reset token for backend users
osv·2022-09-16
CVE-2022-36106 [MEDIUM] TYPO3 CMS missing check for expiration time of password reset token for backend users
TYPO3 CMS missing check for expiration time of password reset token for backend users
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0)
### Problem
It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded.
### Solution
Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above.
### Credits
Thanks to Ingo Fabbri who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue.
### References
* [TYPO3-CORE-SA-2022-008](https://typo3.org/security/advisory/typo3-core-sa-2022-008)
GHSA
TYPO3 CMS missing check for expiration time of password reset token for backend users
ghsa·2022-09-16
CVE-2022-36106 [MEDIUM] CWE-287 TYPO3 CMS missing check for expiration time of password reset token for backend users
TYPO3 CMS missing check for expiration time of password reset token for backend users
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0)
### Problem
It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded.
### Solution
Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above.
### Credits
Thanks to Ingo Fabbri who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue.
### References
* [TYPO3-CORE-SA-2022-008](https://typo3.org/security/advisory/typo3-core-sa-2022-008)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159ahttps://github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2https://typo3.org/security/advisory/typo3-core-sa-2022-008https://github.com/TYPO3/typo3/commit/56af2bd3a432156c30af9be71c9d6f7ef3a6159ahttps://github.com/TYPO3/typo3/security/advisories/GHSA-5959-4x58-r8c2https://typo3.org/security/advisory/typo3-core-sa-2022-008
2022-09-13
Published