CVE-2020-25026: Information Disclosure in TYPO3 extension sf_event_mgt
Summary
CVE-2020-25026: Information Disclosure in TYPO3 extension sf_event_mgt. Affects derhansen/sf_event_mgt across 2 version ranges.
< 4.3.1
>= 5.0.0, < 5.1.1
Fixed in 4.3.1 or 5.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TYPO3 extension sf_event_mgt is a package available on Packagist that provides event management functionality for TYPO3 websites. It allows users to create and manage events, as well as handle participant registration and communication. The extension is widely used in TYPO3 installations and is an integral part of many event-based websites.
Vulnerability Detail
This vulnerability in sf_event_mgt allows an authenticated backend user to access and export participant data for events they do not have permission to access. This can lead to the unauthorized disclosure of sensitive information. Additionally, the vulnerability also enables an authenticated backend user to send emails to event participants for events they are not authorized to access, resulting in a broken access control issue. These vulnerabilities can be exploited by malicious users to gain access to sensitive participant data and potentially perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.14.3.1composer require derhansen/sf_event_mgt:4.3.1 -
>= 5.0.0, < 5.1.15.1.1composer require derhansen/sf_event_mgt:5.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix instructions and update the sf_event_mgt package to the latest secure version.
Conclusion
The sf_event_mgt package in TYPO3 is vulnerable to information disclosure and broken access control issues. It is crucial for TYPO3 administrators to update the package to the recommended secure versions to mitigate the risk of unauthorized access to participant data and misuse of email functionality. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for derhansen/sf_event_mgt →
FAQ
The impact of this vulnerability is the unauthorized disclosure of participant data for events and the ability to send emails to event participants without proper access control. This can lead to the exposure of sensitive information and potential misuse of the email functionality.
TYPO3 installations using the sf_event_mgt package versions 0 to 4.3.0 and versions 5.0.0 to 5.1.0 are affected by this vulnerability. It is important for administrators of such installations to update the package to the recommended secure versions.
You can use the Vulert Playground at Vulert Scanner to check if your TYPO3 installation is affected by this vulnerability. Simply provide your composer.lock file and the playground will analyze it for any vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent any potential exploitation.
You can find more information about this vulnerability in the TYPO3 security advisory TYPO3-EXT-SA-2020-017 at https://typo3.org/security/advisory/typo3-ext-sa-2020-017.
References
Related vulnerabilities
Recent vulnerabilities recorded for derhansen/sf_event_mgt.
