GitHub Advisoryadvisory · Packagist

GHSA-4xp5-hr35-84cx Broken Access Control in extension "femanager"

MEDIUM Published 2023-12-13 Modified 2023-12-13 Official page ↗
Aliases
CVE-2023-50459
Ecosystem
Packagist
Packages
in2code/femanager
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Reviewed
2023-12-13

Affected packages

• Packagist in2code/femanager: >= 7.0.0, < 7.2.3 → fixed in 7.2.3

Description

The extension fails to check access permissions for the edit user component. An authenticated frontend user can use the vulnerability to either edit data of various frontend users or to delete various frontend user accounts. Another missing access check in the backend module of the extensions allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser and resendUserConfirmation) for any frontend user in the system.

Related

Alias · CVE (1)

  • CVE-2023-50459 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. vulnerability

References