CVE-2023-47127— Weak Authentication in Session Handling in typo3/cms-core
Quick assessment
Affected
TYPO3 typo3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TYPO3是瑞士TYPO3协会的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3存在安全漏洞，该漏洞源于为第一个站点生成的会话cookie可以在第二个站点上重复使用，而无需额外的身份验证。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-47127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weak Authentication in Session Handling in typo3/cms-core
Source: CVE Program / CVE List V5
Vulnerability Description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用假设不可变数据进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
TYPO3 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TYPO3是瑞士TYPO3协会的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3存在安全漏洞，该漏洞源于为第一个站点生成的会话cookie可以在第二个站点上重复使用，而无需额外的身份验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-47127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-47127
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-47127 (1)
Vendor Advisories for CVE-2023-47127 (1)
-
https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm x_refsource_CONFIRM
Other References for CVE-2023-47127 (1)
-
https://typo3.org/security/advisory/typo3-core-sa-2023-006 x_refsource_MISC
Same Patch Batch · TYPO3 · 2023-11-14 · 3 CVEs total
| CVE-2023-47125 | 4.7 MEDIUM | By-passing Cross-Site Scripting Protection in HTML Sanitizer |
| CVE-2023-47126 | 3.7 LOW | Information Disclosure in Install Tool in typo3/cms-install |
IV. Related Vulnerabilities
Same product: typo3
-
CVE-2025-47941
TYPO3 Has Broken Authentication in Backend MFA -
CVE-2025-47940
TYPO3 CMS Vulnerable to Privilege Escalation to System Maint -
CVE-2025-47939
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abs -
CVE-2025-47938
TYPO3 Vulnerable to Unverified Password Change for Backend U -
CVE-2025-47937
TYPO3 Vulnerable to Information Disclosure via DBAL Restrict
Same weakness: CWE-302
-
CVE-2026-77508
Weblate: Unverified REST API email changes -
CVE-2026-13267
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-5423
Subscription Authentication Bypass via Unverified connection -
CVE-2026-47303
ASP.NET Core Elevation of Privilege Vulnerability -
CVE-2026-48781
Postiz has cross-tenant SUPERADMIN takeover via Skool-provid
V. Comments for CVE-2023-47127
No comments yet