CVE-2023-25013: Broken Access Control in TYPO3 extension "femanager"
Summary
CVE-2023-25013: Broken Access Control in 3rd party TYPO3 extension "femanager". Affects in2code/femanager across 3 version ranges.
< 5.5.3
>= 6.0.0, < 6.3.4
>= 7.0.0, < 7.1.0
Fixed in 5.5.3, 6.3.4 or 7.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. The "femanager" extension is a popular third-party extension for TYPO3 that provides frontend user registration and management functionality. It allows administrators to create and manage user accounts for the frontend of the TYPO3 website. However, a vulnerability has been discovered in the "femanager" extension that could allow an unauthenticated user with a valid invitation link to set the password of all frontend users.
Vulnerability Detail
The vulnerability stems from a missing access check in the "InvitationController" of the "femanager" extension. This means that an attacker who possesses a valid invitation link can exploit this flaw to set the password of any frontend user without proper authorization. The impact of this vulnerability is significant as it grants unauthorized access to user accounts, potentially leading to unauthorized actions, data breaches, or privilege escalation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.5.35.5.3composer require in2code/femanager:5.5.3 -
>= 6.0.0, < 6.3.46.3.4composer require in2code/femanager:6.3.4 -
>= 7.0.0, < 7.1.07.1.0composer require in2code/femanager:7.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update the affected extension to the latest version as soon as possible.
Conclusion
The "femanager" extension for TYPO3 is vulnerable to a broken access control issue that allows an unauthenticated user to set the password of any frontend user. To mitigate this vulnerability, it is crucial to update the affected extension to the latest patched version. Failure to do so may result in unauthorized access, data breaches, or privilege escalation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for in2code/femanager →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building and managing websites.
"femanager" is a third-party extension for TYPO3 that provides frontend user registration and management functionality. It allows administrators to create and manage user accounts for the frontend of the TYPO3 website.
The vulnerability allows an unauthenticated user with a valid invitation link to set the password of any frontend user without proper authorization. This can lead to unauthorized access, data breaches, or privilege escalation.
To fix this vulnerability, update the affected "femanager" extension to the latest patched version. Refer to the provided version ranges and update instructions in the 'how_to_fix' section.
No, there is no known workaround for this vulnerability. It is recommended to apply the official patch or update the affected extension to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
