GitHub Advisoryadvisory · Packagist

GHSA-93j4-v838-8767 TYPO3 extension femanager Broken Access Control vulnerability

MEDIUM Published 2023-10-04 Modified 2023-10-04 Official page ↗
Aliases
CVE-2023-45023
Ecosystem
Packagist
Packages
in2code/femanager
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2023-10-04

Affected packages

• Packagist in2code/femanager: >= 7.0.0, < 7.2.2 → fixed in 7.2.2

Description

femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.

Related

Alias · CVE (1)

  • CVE-2023-45023 The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References