GitHub Advisoryadvisory · Packagist

GHSA-3p9x-xxx6-2w4p Broken Access Control in 3rd party TYPO3 extension "femanager"

HIGH Published 2023-02-02 Modified 2023-02-08 Official page ↗

Aliases: CVE-2023-25014
Ecosystem: Packagist
Packages: in2code/femanager
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weaknesses: CWE-306
Reviewed: 2023-02-08

Affected packages

• Packagist in2code/femanager: < 5.5.3 → fixed in 5.5.3 • Packagist in2code/femanager: >= 6.0.0, < 6.3.4 → fixed in 6.3.4 • Packagist in2code/femanager: >= 7.0.0, < 7.1.0 → fixed in 7.1.0

Description

A missing access check in the `InvitationController` allows an unauthenticated user to delete all frontend users.

Related

Alias · CVE (1)

CVE-2023-25014 An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. vulnerability

Weakness · CWE (1)

CWE-306 Missing Authentication for Critical Functionality weakness

References