CVE-2023-47127: 
PHP vulnerability analysis and mitigation

CVE-2023-47127 affects TYPO3, an open-source PHP-based web content management system. The vulnerability was discovered in November 2023 and affects multiple versions of TYPO3 (8.0.0-8.7.54, 9.0.0-9.5.43, 10.0.0-10.4.40, 11.0.0-11.5.32, 12.0.0-12.4.7). The issue allows session cookies generated for one site to be reused on another site within the same TYPO3 installation without requiring additional authentication (TYPO3 Advisory, GitHub Advisory).

The vulnerability is classified as a weak authentication issue (CWE-302) in session handling. It has a CVSS v3.1 base score of 4.2 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. The issue occurs when multiple sites exist within the same TYPO3 installation (e.g., first.example.org and second.example.com), where a session cookie generated for the first site can be reused on the second site without requiring additional authentication (TYPO3 Advisory).

The vulnerability primarily affects the frontend of TYPO3 websites and could lead to unauthorized access across different domains within the same TYPO3 installation. However, the impact is somewhat limited as exploiting this vulnerability requires a valid user account (GitHub Advisory).

The vulnerability has been addressed in TYPO3 versions 8.7.55 ELTS, 9.5.44 ELTS, 10.4.41 ELTS, 11.5.33, and 12.4.8. Users are advised to upgrade to these patched versions. There are no known workarounds for this vulnerability (TYPO3 Advisory).