Broken Access Control in extension "femanager"
Summary
CVE-2023-50459: Broken Access Control in extension "femanager". Affects in2code/femanager versions >= 7.0.0, < 7.2.3. Fixed in 7.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The "femanager" extension is a package available on Packagist that provides functionality for managing frontend users in a TYPO3 CMS. It allows administrators to create, edit, and delete user accounts. However, a vulnerability has been discovered in the extension that allows authenticated users to bypass access controls and perform unauthorized actions on frontend user accounts.
Vulnerability Detail
The vulnerability in the "femanager" extension arises from a lack of access permission checks in both the frontend and backend components. In the frontend, an authenticated user can exploit this vulnerability to edit data or delete user accounts of other frontend users. In the backend, an authenticated user can perform actions such as user logout, confirm user, refuse user, and resend user confirmation for any frontend user in the system. This vulnerability poses a moderate risk as it can lead to unauthorized access and manipulation of user accounts.
How To Fix
Minimum fixed version
7.2.3
This is the first release that contains the fix.
composer require in2code/femanager:7.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the extension to the latest version to mitigate the risk.
Conclusion
The "femanager" extension in TYPO3 CMS is vulnerable to a broken access control issue that allows authenticated users to perform unauthorized actions on frontend user accounts. To mitigate this vulnerability, it is crucial to update the extension to version 7.2.3 or later. Additionally, it is recommended to regularly check for vulnerabilities using tools like Vulert to ensure the security of your application.
See every vulnerability recorded for in2code/femanager →
FAQ
This vulnerability allows authenticated users to bypass access controls and perform unauthorized actions on frontend user accounts. It can lead to data manipulation, unauthorized access, and potential disruption of user accounts.
Any TYPO3 CMS installation that has the "femanager" extension version 7.0.0 to 7.2.2 installed is affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the extension to the latest version to prevent potential exploitation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will alert you if the "femanager" extension is vulnerable.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
