GitHub Advisoryadvisory · Packagist

GHSA-772m-43f3-hmf8 TYPO3 Broken Access Control in Localization Handling

MEDIUM Published 2024-06-07 Modified 2024-06-07 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-285
Reviewed
2024-06-07

Affected packages

• Packagist typo3/cms: >= 8.0.0, < 8.7.23 → fixed in 8.7.23

Description

It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References