• Component Type: TYPO3 CMS
• Vulnerable subcomponent: Frontend Session Handling (ext:frontend)
• Release Date: June 25, 2019
• Vulnerability Type: Security Misconfiguration
• Affected Versions: 8.5.0-8.7.26 and 9.0.0-9.5.7
• Severity: Low
• Suggested CVSS v3.0: AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:F/RL:O/RC:C
• CVE: not assigned yet

Problem Description

It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.

Solution

Update to TYPO3 versions 8.7.27 or 9.5.8 that fix the problem described.

Strong security defaults - Manual actions required

In order to apply strong security defaults existing session data will be purged once a frontend user logs out. In order to disable this behavior the following settings can be applied individually:

$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.keepSessionDataOnLogout'] = 1;

This can be done by either using Install Tool or according deployment techniques.

Credits

Thanks to Christian Ebert who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note

All security related code changes are tagged so that you can easily look them up in our review system.