GHSA-ppvg-hw62-6ph9: TYPO3 Security Misconfiguration in Install Tool Cookie

May 30, 2024

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2018-12-11-4.yaml
github.com/TYPO3-CMS/core
github.com/advisories/GHSA-ppvg-hw62-6ph9
typo3.org/security/advisory/typo3-core-sa-2018-009

Detect and mitigate GHSA-ppvg-hw62-6ph9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →