Detections
Analytics
SCA: security update for typo3/cms, typo3/cms-core (GHSA-m392-235j-9r7r)
medium Tenable Cloud Security Plugin ID 416681
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been
discovered that observing response time during user authentication (backend and frontend) can be used to
distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3
extensions providing a custom authentication service should check if the extension is affected by the
described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which
simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS,
8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for
this issue. (CVE-2022-36105)
See Also
Plugin Details
Severity: Medium
ID: 416681
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 1/27/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2022-36105
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/16/2022
Vulnerability Publication Date: 9/13/2022
Reference Information
CVE: CVE-2022-36105
cwe: CWE-203