CVE-2023-25014: Broken Access Control in TYPO3 extension "femanager"
Summary
CVE-2023-25014: Broken Access Control in 3rd party TYPO3 extension "femanager". Affects in2code/femanager across 3 version ranges.
< 5.5.3
>= 6.0.0, < 6.3.4
>= 7.0.0, < 7.1.0
Fixed in 5.5.3, 6.3.4 or 7.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system that allows users to create and manage websites. The "femanager" extension is a popular third-party extension for TYPO3 that provides frontend user registration and management functionality. It allows website administrators to create, edit, and delete frontend user accounts. However, a vulnerability in the extension's "InvitationController" component allows an unauthenticated user to delete all frontend user accounts, bypassing access controls.
Vulnerability Detail
The vulnerability arises from a missing access check in the "InvitationController" of the "femanager" extension. This allows an attacker without proper authentication to send a specially crafted request to the controller, resulting in the deletion of all frontend user accounts. The impact of this vulnerability is significant, as it can lead to the unauthorized removal of user accounts and potential disruption of website functionality. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.5.35.5.3composer require in2code/femanager:5.5.3 -
>= 6.0.0, < 6.3.46.3.4composer require in2code/femanager:6.3.4 -
>= 7.0.0, < 7.1.07.1.0composer require in2code/femanager:7.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the patched version of the "femanager" extension as soon as possible to mitigate the risk of unauthorized deletion of frontend user accounts.
Conclusion
The "femanager" extension for TYPO3 is vulnerable to a broken access control issue in the "InvitationController" component. This vulnerability allows an unauthenticated user to delete all frontend user accounts, potentially leading to the unauthorized removal of user accounts and disruption of website functionality. Users of the extension should upgrade to the latest patched version to address this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for in2code/femanager →
FAQ
TYPO3 is an open-source content management system that allows users to create and manage websites. It provides a flexible and extensible platform for building web applications.
"femanager" is a third-party extension for TYPO3 that adds frontend user registration and management functionality. It allows website administrators to create, edit, and delete frontend user accounts.
The vulnerability allows an unauthenticated user to delete all frontend user accounts, bypassing access controls. This can lead to the unauthorized removal of user accounts and potential disruption of website functionality.
To fix this vulnerability, upgrade to the latest patched version of the "femanager" extension. Refer to the provided version ranges and upgrade instructions for your specific version.
No, there is no known workaround for this vulnerability. It is essential to upgrade to the patched version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
