GitHub Advisoryadvisory · Packagist

GHSA-cvgc-mx2w-h3w8 The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference

HIGH Published 2025-05-21 Modified 2025-05-21 Official page ↗
Aliases
CVE-2025-48205
Ecosystem
Packagist
Packages
sjbr/sr-feuser-register
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-425, CWE-639
Reviewed
2025-05-21

Affected packages

• Packagist sjbr/sr-feuser-register: >= 5.1.0, < 12.5.0 → fixed in 12.5.0

Description

The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. This allows attackers to read arbitrary files.

Related

Alias · CVE (1)

  • CVE-2025-48205 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. vulnerability

Weakness · CWE (2)

  • CWE-425 Direct Request weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References