GitHub Advisoryadvisory · Packagist

GHSA-4576-pgh2-g34j derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module

MEDIUM Published 2024-02-13 Modified 2024-02-13 Official page ↗
Aliases
CVE-2024-24751
Ecosystem
Packagist
Packages
derhansen/sf_event_mgt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284, CWE-863
Reviewed
2024-02-13

Affected packages

• Packagist derhansen/sf_event_mgt: >= 7.0.0, < 7.4.0 → fixed in 7.4.0

Description

The existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled.

Related

Alias · CVE (1)

  • CVE-2024-24751 sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References