PT-2023-31562 · Typo3 · Femanager Extension

Publicado 2023-12-13 · Atualizado 2023-12-15 · CVE-2023-50459

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions femanager Extension extension for TYPO3 (affected versions not specified)

Description The issue concerns a security bypass in the femanager Extension for TYPO3. It is caused by a missing access check for the edit user component, allowing an authenticated frontend user to edit or delete data of various frontend users. Additionally, a missing access check in the backend module enables an authenticated backend user to perform actions such as userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2023-50459

GHSA-4XP5-HR35-84CX

Produtos afetados

Femanager Extension

Referências · 4

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-50459.yaml · Exploit
• https://twitter.com/RedPacketSec/status/1735602626035683354 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4xp5-hr35-84cx · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-ext-sa-2023-010 · Nota