PT-2024-28249 · Typo3 · Friendlycaptcha Official

Sebastian Müller · Published 2024-06-21 · Updated 2024-10-25 · CVE-2024-38873

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions friendlycaptcha official extension versions prior to 0.1.4 for TYPO3

Description The issue allows a remote user to bypass the captcha check due to the extension's failure to verify the captcha field in submitted form data. This specifically affects the captcha integration for the ext:form extension.

Recommendations For versions prior to 0.1.4, update to version 0.1.4 or later to resolve the issue. As a temporary workaround, consider disabling the captcha integration for the ext:form extension until the update is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-38873

GHSA-JG62-H7PV-HXGV

Affected Products

Friendlycaptcha Official

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/studiomitte/friendlycaptcha/CVE-2024-38873.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-38873 · Security Note
• https://osv.dev/vulnerability/GHSA-jg62-h7pv-hxgv · Vendor Advisory
• https://github.com/studiomitte/friendlycaptcha-typo3 · Note
• https://t.me/cvenotify/83983 · Telegram Post
• https://typo3.org/security/advisory/typo3-ext-sa-2024-004 · Note