CVE-2009-3818: Vulnerability in freeCap CAPTCHA Extension for TYPO3 - Session Handling Flaw
Summary
CVE-2009-3818: freeCap CAPTCHA extension for TYPO3 has vulnerability in the session handling feature. Affects sjbr/sr-freecap versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The freeCap CAPTCHA extension (sr_freecap) for TYPO3 is designed to enhance web forms by providing CAPTCHA functionality, which helps prevent automated submissions. This extension is widely used in TYPO3 applications to improve security by ensuring that form submissions are made by humans. However, versions 1.2.0 and earlier have a vulnerability in the session handling feature, which could potentially be exploited by attackers.
Vulnerability Detail
An unspecified vulnerability exists in the session handling feature of the freeCap CAPTCHA extension (sr_freecap) version 1.2.0 and earlier. This flaw may allow attackers to manipulate session data, leading to unauthorized access or other malicious activities. The exact impact and attack vectors remain unknown, but the potential for exploitation poses a moderate risk to applications utilizing this extension.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
composer require sjbr/sr-freecap:1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the CAPTCHA functionality in your forms until the extension is updated. This can be done by commenting out or removing the relevant code in your TYPO3 configuration that invokes the freeCap CAPTCHA.
Conclusion
The freeCap CAPTCHA extension for TYPO3 has a moderate vulnerability in its session handling feature, affecting versions 1.2.0 and earlier. It is crucial for users to update to version 1.2.2 or later to mitigate potential risks. Temporary workarounds are available, but updating is the best course of action.
See every vulnerability recorded for sjbr/sr-freecap →
FAQ
The vulnerability is related to session handling, which could allow unauthorized access or manipulation of session data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider disabling the CAPTCHA functionality as a temporary workaround.
While the exact ramifications are unknown, there is a potential risk of unauthorized access which could lead to data manipulation or loss.
More details can be found in the official advisory on GitHub or by searching for CVE-2009-3818.
Related vulnerabilities
Recent vulnerabilities recorded for sjbr/sr-freecap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
