PT-2023-31562 · Typo3 · Femanager Extension

Published 2023-12-13 · Updated 2023-12-15 · CVE-2023-50459

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions femanager Extension extension for TYPO3 (affected versions not specified)

Description The issue concerns a security bypass in the femanager Extension for TYPO3. It is caused by a missing access check for the edit user component, allowing an authenticated frontend user to edit or delete data of various frontend users. Additionally, a missing access check in the backend module enables an authenticated backend user to perform actions such as userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-50459

GHSA-4XP5-HR35-84CX

Affected Products

Femanager Extension

References · 4

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-50459.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-4xp5-hr35-84cx · Vendor Advisory
• https://twitter.com/RedPacketSec/status/1735602626035683354 · Twitter Post
• https://typo3.org/security/advisory/typo3-ext-sa-2023-010 · Note