What’s Vulnerable › Vulnerabilities

CVE-2023-47127: Weak Authentication in Session Handling in typo3/cms-core

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-14 · updated 2026-06-17
• Weakness: CWE-302

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• typo3: from 8.0.0 before 8.7.55; from 9.0.0 before 9.5.44; from 10.0.0 before 10.4.41; from 11.0.0 before 11.5.33; from 12.0.0 before 12.4.8 — fixed in 10.4.41, 11.5.33, 12.4.8, 8.7.55, 9.5.44

How to fix

Upgrade to a fixed version: typo3 10.4.41, 11.5.33, 12.4.8, 8.7.55. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019
• https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm
• https://typo3.org/security/advisory/typo3-core-sa-2023-006
• https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019
• https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm
• https://typo3.org/security/advisory/typo3-core-sa-2023-006

Get alerted when CVE-2023-47127 or the next vulnerability affects your stack