GitHub Advisoryadvisory · Packagist

GHSA-cchp-3rq6-69wj events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability

MEDIUM Published 2024-06-21 Modified 2025-03-24 Official page ↗
Aliases
CVE-2024-38874
Ecosystem
Packagist
Packages
jweiland/events2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-639, CWE-693
Reviewed
2024-06-21

Affected packages

• Packagist jweiland/events2: < 8.3.8 → fixed in 8.3.8 • Packagist jweiland/events2: >= 9.0.0, < 9.0.6 → fixed in 9.0.6

Description

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

Related

Alias · CVE (1)

  • CVE-2024-38874 An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. vulnerability

Weakness · CWE (2)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-693 Protection Mechanism Failure weakness

References