PT-2023-29362 · Femanager · Femanager

Publicado 2023-10-04 · Atualizado 2023-10-04 · CVE-2023-45023

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions femanager (affected versions not specified)

Description The issue concerns a lack of proper access permission checks for the invitation component in femanager. This can allow a remote user to create frontend user accounts with access to configured frontend groups, depending on the plugin's configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-45023

GHSA-93J4-V838-8767

Produtos afetados

Femanager

Referências · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-45023.yaml · Exploit
• https://github.com/in2code-de/femanager · Nota
• https://github.com/in2code-de/femanager/commit/cc5f2893613a6b3fd2677c457574ab587a0862ca · Nota
• https://github.com/in2code-de/femanager/releases/tag/7.2.2 · Nota
• https://osv.dev/vulnerability/GHSA-93j4-v838-8767 · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-ext-sa-2023-008 · Nota