CVE-2023-47127

    Dashboard / Vulnerabilities / CVE-2023-47127

    CVE-2023-47127

    Published: 14 Nov 2023Last Modified: 27 Aug 2026

    Summary: Weak Authentication in Session Handling in typo3/cms-core

    Details: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47127.json, https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm, https://nvd.nist.gov/vuln/detail/CVE-2023-47127, https://typo3.org/security/advisory/typo3-core-sa-2023-006, https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234
    Fixed -939ef26e7fcd18ec68af7743014446a45527e502

    Affected versions

    v11.5.32
    v11.5.31
    v11.5.30
    v11.5.29
    v11.5.28
    v11.5.27
    v11.5.26
    v11.5.25
    v11.5.24
    v11.5.23
    v11.5.22
    v11.5.21
    v11.5.20
    v11.5.19
    v11.5.18
    v11.5.17
    v11.5.16
    v11.5.15
    v11.5.14
    v11.5.13
    v11.5.12
    v11.5.11
    v11.5.10
    v11.5.9
    v11.5.8
    v11.5.7
    v11.5.6
    v11.5.5
    v11.5.4
    v11.5.3
    v11.5.2
    v11.5.1
    v11.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-47127 | CVE-DB