Vulnerability CVE-2009-0256

Vulnerability Name:

CVE-2009-0256 (CCN-48133)

Assigned:

2009-01-20

Published:

2009-01-20

Updated:

2017-08-08

Summary:

Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-287

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-0256

Source: CCN
Type: SA33617
Typo3 Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
33617

Source: SECUNIA
Type: UNKNOWN
33679

Source: CCN
Type: TYPO3-SA-2009-001
Multiple vulnerabilities in TYPO3 Core

Source: CONFIRM
Type: Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/

Source: DEBIAN
Type: UNKNOWN
DSA-1711

Source: DEBIAN
Type: DSA-1711
typo3-src -- several vulnerabilities

Source: CCN
Type: OSVDB ID: 53541
Typo3 Authentication Library Session ID Re-use Session Fixation

Source: CCN
Type: OSVDB ID: 53542
Typo3 Indexed Search Engine (indexed_search) Indexed File XSS

Source: CCN
Type: OSVDB ID: 53543
Typo3 ADOdb System Extension test.php ADODB_vers Parameter XSS

Source: CCN
Type: OSVDB ID: 53544
Typo3 Workspace Module Unspecified XSS

Source: BID
Type: UNKNOWN
33376

Source: CCN
Type: BID-33376
TYPO3 Multiple Remote Vulnerabilities

Source: XF
Type: UNKNOWN
typo3-library-session-hijacking(48133)

Source: XF
Type: UNKNOWN
typo3-library-session-hijacking(48133)

Vulnerable Configuration:

Configuration 1:

cpe:/a:typo3:typo3:4.0:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.8:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.0.9:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.0:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.0:beta1:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.0:rc1:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.1:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.2:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.3:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.4:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.5:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.6:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1.7:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.2.0:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.2.1:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.2.2:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.2.3:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:typo3:typo3:4.0:*:*:*:*:*:*:*

OR cpe:/a:typo3:typo3:4.1:*:*:*:*:*:*:*