GHSA-f777-f784-36gm
TYPO3 Security Misconfiguration in Install Tool Cookie
GHSA-f777-f784-36gm is a high vulnerability (CVSS 8.1) in typo3/cms, published June 7, 2024. No source lists public exploit code. Fixed in typo3/cms 7.6.32.
- Severity
- 8.1 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.6.32typo3/cms +5 more
Description
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 7.0.0 up to 7.6.32 | 7.6.32 |
typo3/cmsPackagist | 8.0.0 up to 8.7.21 | 8.7.21 |
typo3/cmsPackagist | 9.0.0 up to 9.5.2 | 9.5.2 |
typo3/cmsPackagist | 7.0.0 up to 7.6.32, plus listed versions 7.0.17.0.27.1.07.2.07.3.0 Show 35 moreShow less7.3.17.4.07.5.07.6.07.6.17.6.107.6.117.6.127.6.137.6.147.6.157.6.167.6.177.6.187.6.197.6.27.6.37.6.47.6.57.6.67.6.77.6.87.6.9v7.6.20v7.6.21v7.6.22v7.6.23v7.6.24v7.6.25v7.6.26v7.6.27v7.6.28v7.6.29v7.6.30v7.6.31 | 7.6.32 |
typo3/cmsPackagist | 8.0.0 up to 8.7.21, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 30 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 | 8.7.21 |
typo3/cmsPackagist | 9.0.0 up to 9.5.2, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 6 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1 | 9.5.2 |
What each source reports
GitHub Advisories Score used
TYPO3 Security Misconfiguration in Install Tool Cookie
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
- Record
GHSA-f777-f784-36gm- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-1004
- Updated
- 2026-11-02
OSV
TYPO3 Security Misconfiguration in Install Tool Cookie
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
- Record
GHSA-f777-f784-36gm- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-1004
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/TYPO3/typo3/commit/13328b0f74ac589a20b021db814dfa672581c26a
typo3.org/security/advisory/typo3-core-sa-2018-009