GitHub Advisoryadvisory · Packagist

GHSA-xxwr-wv9g-7jw3 The femanager TYPO3 extension allows Insecure Direct Object Reference

MEDIUM Published 2025-05-21 Modified 2025-05-21 Official page ↗
Aliases
CVE-2025-48202
Ecosystem
Packagist
Packages
in2code/femanager
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C
Weaknesses
CWE-284, CWE-425, CWE-639
Reviewed
2025-05-21

Affected packages

• Packagist in2code/femanager: >= 8.0.0, < 8.2.2 → fixed in 8.2.2 • Packagist in2code/femanager: >= 7.0.0, < 7.4.2 → fixed in 7.4.2 • Packagist in2code/femanager: >= 6.0.0, < 6.4.1 → fixed in 6.4.1 • Packagist in2code/femanager: >= 5.5.0, < 5.5.5 → fixed in 5.5.5

Description

Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController.

Related

Alias · CVE (1)

  • CVE-2025-48202 The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. vulnerability

Weakness · CWE (3)

  • CWE-284 Improper Access Control weakness
  • CWE-425 Direct Request weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References