CVE-2023-45023: TYPO3 extension femanager Broken Access Control vulnerability
Summary
CVE-2023-45023: TYPO3 extension femanager Broken Access Control vulnerability. Affects in2code/femanager versions >= 7.0.0, < 7.2.2. Fixed in 7.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TYPO3 extension femanager is a popular package used for managing frontend user accounts in TYPO3 CMS. It provides features for creating, editing, and deleting frontend user accounts, as well as managing access permissions for these accounts. The extension is widely used in TYPO3 websites to handle user registration and authentication processes. However, a vulnerability has been discovered in femanager that allows remote users to bypass access controls and create frontend user accounts with access to configured frontend groups.
Vulnerability Detail
The vulnerability in femanager arises from a failure to properly check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can exploit this vulnerability to create frontend user accounts with access to frontend groups that they should not have access to. This can lead to unauthorized access to sensitive information or functionality within the TYPO3 website. The vulnerability has been assigned the identifier CVE-2023-45023.
How To Fix
Minimum fixed version
7.2.2
This is the first release that contains the fix.
composer require in2code/femanager:7.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the femanager extension to the fixed version to mitigate the risk.
Conclusion
The femanager extension for TYPO3 is vulnerable to a broken access control vulnerability that allows remote users to create frontend user accounts with unauthorized access to frontend groups. To mitigate this risk, it is important to update the femanager extension to version 7.2.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for in2code/femanager →
FAQ
femanager is a TYPO3 extension used for managing frontend user accounts in TYPO3 CMS. It provides features for user registration, authentication, and access control.
The vulnerability allows remote users to bypass access controls and create frontend user accounts with unauthorized access to frontend groups. This can lead to unauthorized access to sensitive information or functionality within the TYPO3 website.
To fix this vulnerability, update the femanager extension to version 7.2.2 or later.
No, there is no known workaround for this vulnerability. Updating the femanager extension is the only way to mitigate the risk.
You can find more information about this vulnerability in the official TYPO3 security advisories or by contacting the TYPO3 security team.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
