Lucene search

GitHub Advisory DatabaseGHSA-MM8V-WMQX-8H2J

HistoryFeb 02, 2023 - 3:30 a.m.

Broken Access Control in 3rd party TYPO3 extension "femanager"

2023-02-0203:30:23

CWE-306

GitHub Advisory Database

github.com

access control

typo3

femanager

invitationcontroller

security flaw

unauthenticated user

frontend users

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

EPSS

0.001

Percentile

30.1%

JSON

A missing access check in the InvitationController allows an unauthenticated user with a valid invitation link to set the password of all frontend users.

Affected configurations

Vulners

Node

in2codefemanagerRange7.0.0–7.1.0typo3

in2codefemanagerRange6.0.0–6.3.4typo3

in2codefemanagerRange<5.5.3typo3

VendorProductVersionCPE
in2codefemanager*cpe:2.3:a:in2code:femanager:*:*:*:*:*:typo3:*:*

Vendor	Product	Version	CPE
in2code	femanager	*	cpe:2.3:a:in2code:femanager::::::typo3::*

References

github.com/advisories/GHSA-mm8v-wmqx-8h2j

github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-25013.yaml

nvd.nist.gov/vuln/detail/CVE-2023-25013

typo3.org/security/advisory/typo3-ext-sa-2023-001

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

EPSS

0.001

Percentile

30.1%

JSON

Related for GHSA-MM8V-WMQX-8H2J