CVE-2012-5890: sjbr/sr-feuser-register - Remote User Credentials Exposure Vulnerability
Summary
CVE-2012-5890: The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature. Affects sjbr/sr-feuser-register versions < 2.6.2. Fixed in 2.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sjbr/sr-feuser-register is an extension for TYPO3 that facilitates front-end user registration. It allows users to register, edit their profiles, and manage their accounts through a user-friendly interface. However, prior to version 2.6.2, this extension had a significant security flaw that could be exploited by remote attackers to gain unauthorized access to user credentials.
Vulnerability Detail
The vulnerability arises from improper handling of user credentials in the sjbr/sr-feuser-register extension before version 2.6.2. Attackers could exploit this flaw through the edit perspective or the autologin feature, allowing them to retrieve user names and passwords. This could lead to unauthorized access to user accounts, compromising sensitive information and potentially leading to further attacks within the system.
How To Fix
Minimum fixed version
2.6.2
This is the first release that contains the fix.
composer require sjbr/sr-feuser-register:2.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the edit perspective and autologin features in the sjbr/sr-feuser-register extension settings until you can apply the patch. This will help mitigate the risk of exploitation until the update is completed.
Conclusion
The sjbr/sr-feuser-register extension for TYPO3 has a critical vulnerability that allows remote attackers to access user credentials. It is crucial to update to version 2.6.2 or later to mitigate this risk. Additionally, temporary workarounds can be implemented until the update is applied.
See every vulnerability recorded for sjbr/sr-feuser-register →
FAQ
CVE-2012-5890 is a vulnerability identifier that refers to a security flaw in the sjbr/sr-feuser-register extension for TYPO3, allowing remote attackers to access user credentials.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to user accounts, compromising sensitive information and potentially allowing further attacks.
Yes, the vulnerability has been patched in version 2.6.2 of the sjbr/sr-feuser-register extension. It is recommended to update to this version or later.
If you cannot update immediately, disable the edit perspective and autologin features in the extension settings to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for sjbr/sr-feuser-register.
