PT-2025-22374 · Typo3 · Sr Feuser Register

Published 2025-05-20 · Updated 2025-12-27 · CVE-2025-48205

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sr feuser register extension for TYPO3 versions through 12.4.8

Description The issue allows for Insecure Direct Object Reference, enabling attackers to read arbitrary files. This could potentially lead to unauthorized access to sensitive information.

Recommendations For versions through 12.4.8, consider disabling the sr feuser register extension until a patch is available to prevent exploitation. Restrict access to sensitive files and directories to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

CWE-425

Related Identifiers

BDU:2025-06007

CVE-2025-48205

GHSA-CVGC-MX2W-H3W8

Affected Products

Sr Feuser Register

References · 10

• https://osv.dev/vulnerability/GHSA-cvgc-mx2w-h3w8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48205 · Security Note
• https://bdu.fstec.ru/vul/2025-06007 · Security Note
• https://t.me/cvetracker/24386 · Telegram Post
• https://twitter.com/CveFindCom/status/1925215081198960992 · Twitter Post
• https://codeberg.org/sjbr/sr-feuser-register/commit/be44f61a475371c36b2035cbb523b56f5e34267d · Note
• https://typo3.org/security/advisory/typo3-ext-sa-2025-008 · Note
• https://codeberg.org/sjbr/sr-feuser-register · Note
• https://twitter.com/CVEnew/status/2005031814423883825 · Twitter Post
• https://t.me/latest_high_impact_cve/2434 · Telegram Post