GHSA-ppvg-hw62-6ph9: 
PHP vulnerability analysis and mitigation

A security misconfiguration vulnerability was discovered in TYPO3 CMS Install Tool Cookie (GHSA-ppvg-hw62-6ph9), affecting versions 7.0.0-7.6.31, 8.0.0-8.7.20, and 9.0.0-9.5.1. The vulnerability was disclosed on December 11, 2018, impacting the Install Tool Session Handling component of TYPO3 CMS (TYPO3 Advisory).

The vulnerability stems from cookies created in the Install Tool not being properly hardened for HTTP-only submission. The issue has been assigned a High severity rating with a CVSS v3.1 base score of 7.5. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network vector attack, low complexity, no privileges required, and no user interaction needed (GitHub Advisory).

When exploited, particularly in combination with other vulnerabilities such as cross-site scripting, this security misconfiguration could lead to the hijacking of active and valid sessions in the Install Tool (TYPO3 Advisory).

The vulnerability requires network access and can be exploited with low complexity, requiring no special privileges or user interaction. The attack vector is network-based, making it accessible to remote attackers (GitHub Advisory).

The vulnerability has been patched in TYPO3 versions 7.6.32, 8.7.21, and 9.5.2. Users are advised to update to these patched versions and clear the Typo3InstallTool cookie in web browsers. The fix was implemented by TYPO3 core team member Andreas Wolf (TYPO3 Advisory).