GitHub Advisoryadvisory · Packagist

GHSA-9rx9-7fmh-gj3g TYPO3 Broken Access Control in Localization Handling

MEDIUM Published 2024-05-30 Modified 2024-05-30 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-269
Reviewed
2024-05-30

Affected packages

• Packagist typo3/cms-core: >= 8.0.0, < 8.7.23 → fixed in 8.7.23

Description

It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References