PT-2023-29362 · Femanager · Femanager

Published 2023-10-04 · Updated 2023-10-04 · CVE-2023-45023

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions femanager (affected versions not specified)

Description The issue concerns a lack of proper access permission checks for the invitation component in femanager. This can allow a remote user to create frontend user accounts with access to configured frontend groups, depending on the plugin's configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-45023

GHSA-93J4-V838-8767

Affected Products

Femanager

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-45023.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-93j4-v838-8767 · Vendor Advisory
• https://github.com/in2code-de/femanager · Note
• https://github.com/in2code-de/femanager/commit/cc5f2893613a6b3fd2677c457574ab587a0862ca · Note
• https://github.com/in2code-de/femanager/releases/tag/7.2.2 · Note
• https://typo3.org/security/advisory/typo3-ext-sa-2023-008 · Note