GHSA-93j4-v838-8767

TYPO3 extension femanager Broken Access Control vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-45023

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	in2code/femanager	>= 7.0.0, < 7.2.2	7.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.

References

External links from the advisory. They lead to third-party sites.

https://github.com/in2code-de/femanager/commit/cc5f2893613a6b3fd2677c457574ab587a0862ca web
https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-45023.yaml web
https://github.com/in2code-de/femanager package
https://github.com/in2code-de/femanager/releases/tag/7.2.2 web
https://typo3.org/security/advisory/typo3-ext-sa-2023-008 web