CVE-2022-47406

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-14 · updated 2026-06-17
Weakness: CWE-613

Description

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

Affected products

Change Password For Frontend Users Project Change Password For Frontend Users: before 2.0.5; from 3.0.0 before 3.0.3 — fixed in 2.0.5, 3.0.3

How to fix

Upgrade to a fixed version: Change Password For Frontend Users Project Change Password For Frontend Users 2.0.5, 3.0.3. Check the vendor advisory for mitigations.

References

https://typo3.org/security/advisory/typo3-ext-sa-2022-016
https://typo3.org/security/advisory/typo3-ext-sa-2022-016

Get alerted when CVE-2022-47406 or the next vulnerability affects your stack