CVE-2022-47406

The fe_change_pwd extension for TYPO3, which allows frontend users to change their passwords, contains a vulnerability in versions before 2.0.5 and 3.x before 3.0.3. The extension does not revoke existing sessions for the user after a password change [1][4]. This means that an attacker who gains access to a valid session token can continue to use it even after the legitimate user changes their password.

Exploitation requires the attacker to have obtained a valid session identifier before the password change, such as through session hijacking or theft. No additional authentication is needed beyond the existing session. The attack vector is network-based, and the attacker does not need any special privileges beyond the user's session [4].

The impact is that an attacker can maintain unauthorized access to the user's account even after the password is changed. This could lead to disclosure of sensitive information (confidentiality) or unauthorized modification of data (integrity), as the attacker retains the same privileges as the legitimate user [4]. The CVSS v3.1 score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N [4].

The vulnerability has been patched in versions 2.0.5 and 3.0.3 of the extension. Users are advised to update as soon as possible [4]. The TYPO3 security advisory credits Torben Hansen for reporting and fixing the issue [4].