GHSA-f777-f784-36gm: 
PHP vulnerability analysis and mitigation

A security misconfiguration was discovered in TYPO3 CMS Install Tool Cookie (GHSA-f777-f784-36gm) affecting versions 7.0.0-7.6.31, 8.0.0-8.7.20, and 9.0.0-9.5.1. The vulnerability was disclosed on December 11, 2018, impacting the Install Tool Session Handling component of TYPO3 CMS (TYPO3 Advisory).

The vulnerability stems from cookies created in the Install Tool not being properly hardened for HTTP-only submission. The issue has a CVSS v3.1 base score of 8.1 (High severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (GitHub Advisory).

When combined with other vulnerabilities such as cross-site scripting, this security misconfiguration could lead to the hijacking of active and valid sessions in the Install Tool (TYPO3 Advisory).

The vulnerability requires network access and low complexity to exploit, with low privileges required and no user interaction needed, as indicated by the CVSS metrics (GitHub Advisory).

The vulnerability was patched in TYPO3 versions 7.6.32, 8.7.21, and 9.5.2. Users are advised to update to these versions and clear the Typo3InstallTool cookie in web browsers (TYPO3 Advisory).