CVE-2022-36105

User Enumeration via Response Timing in TYPO3

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue.

TYPO3 es un sistema de administración de contenidos web de código abierto basado en PHP y publicado bajo la licencia GNU GPL. Se ha detectado que la observación del tiempo de respuesta durante la autenticación del usuario (backend y frontend) puede usarse para distinguir entre cuentas de usuario existentes y no existentes. Los autores de extensiones de TYPO3 de terceros que proporcionan un servicio de autenticación personalizado deben comprobar si la extensión está afectada por el problema descrito. Las extensiones afectadas deben implementar el nuevo "MimicServiceInterface::mimicAuthUser", que simula los tiempos correspondientes al procesamiento normal. Actualice a TYPO3 versiones 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 o 11.5.16 que corrigen este problema. No se presentan mitigaciones conocidas para este problema

*Credits: N/A

CVSS Scores

NISTv3.1 5.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-07-15 CVE Reserved
2022-09-13 CVE Published
2024-04-05 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-203: Observable Discrepancy

CAPEC

References (3)

URL	Tag	Source
https://github.com/TYPO3/typo3/security/advisories/GHSA-m392-235j-9r7r	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/TYPO3/typo3/commit/f8b83ce15d4ea275a5a5e564e5d324242f7937b6	2022-09-16

URL	Date	SRC
https://typo3.org/security/advisory/typo3-core-sa-2022-007	2022-09-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 7.0.0 <= 7.6.57 Search vendor "Typo3" for product "Typo3" and version " >= 7.0.0 <= 7.6.57"		-		Affected
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 8.0.0 <= 8.7.47 Search vendor "Typo3" for product "Typo3" and version " >= 8.0.0 <= 8.7.47"		-		Affected
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 9.0.0 <= 9.5.36 Search vendor "Typo3" for product "Typo3" and version " >= 9.0.0 <= 9.5.36"		-		Affected
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 10.0.0 <= 10.4.31 Search vendor "Typo3" for product "Typo3" and version " >= 10.0.0 <= 10.4.31"		-		Affected
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 11.0.0 <= 11.5.15 Search vendor "Typo3" for product "Typo3" and version " >= 11.0.0 <= 11.5.15"		-		Affected