GitHub Advisoryadvisory · Packagist

GHSA-59m9-p6cm-94q5 TYPO3 Extension femanager vulnerable to Broken Access Control

MEDIUM Published 2022-11-03 Modified 2023-12-12 Official page ↗
Aliases
CVE-2022-44543
Ecosystem
Packagist
Packages
in2code/femanager
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Reviewed
2022-11-03

Affected packages

• Packagist in2code/femanager: >= 7.0.0, < 7.0.1 → fixed in 7.0.1 • Packagist in2code/femanager: >= 6.0.0, < 6.3.3 → fixed in 6.3.3 • Packagist in2code/femanager: < 5.5.2 → fixed in 5.5.2

Description

The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to broken access control. The `usergroup.inList` validation can be bypassed resulting in new frontend users created by the extension may be members of groups that are restricted. The vulnerability is only exploitable if the field usergroup is available in the registration form. Versions 5.5.2, 6.3.3, and 7.0.1 contain patches.

Related

Alias · CVE (1)

  • CVE-2022-44543 The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted… vulnerability

References