PT-2025-22371 · Typo3 · Femanager

Published 2025-05-20 · Updated 2025-12-27 · CVE-2025-48202

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 8.2.2

Description The issue allows attackers to view frontend user data. This is achieved through an Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension, where attackers can exploit a user parameter in the newAction of the newController.

Recommendations For versions prior to 8.2.2, update to version 8.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the newAction of the newController to minimize the risk of exploitation. Avoid using the user parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

CWE-425

Related Identifiers

BDU:2025-05996

CVE-2025-48202

GHSA-XXWR-WV9G-7JW3

Affected Products

Femanager

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2025-48202.yaml · Exploit
• https://bdu.fstec.ru/vul/2025-05996 · Security Note
• https://osv.dev/vulnerability/GHSA-xxwr-wv9g-7jw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48202 · Security Note
• https://github.com/in2code-de/femanager · Note
• https://github.com/in2code-de/femanager/commit/54851f8f60254bd8060bdf7bc16d56f4de7bd828 · Note
• https://typo3.org/security/advisory/typo3-ext-sa-2025-006 · Note
• https://twitter.com/CVEnew/status/2005031812670570928 · Twitter Post
• https://t.me/cvetracker/24383 · Telegram Post