Remote Record Modification Vulnerability in TYPO3 femanager Extension
Summary
CVE-2014-6292: The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors. Affects in2code/femanager versions < 1.0.9. Fixed in 1.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TYPO3 femanager extension is a widely used tool for managing frontend user registrations and profiles in TYPO3 applications. It provides functionalities such as user registration, profile editing, and password management. However, prior to version 1.0.9, the extension had a critical vulnerability that allowed unauthorized frontend users to modify or delete records of other users, compromising user data integrity and security.
Vulnerability Detail
The femanager extension before version 1.0.9 for TYPO3 contains a vulnerability that allows remote frontend users to modify or delete the records of other frontend users. This issue arises from unspecified vectors that fail to properly validate user permissions, leading to unauthorized access and manipulation of user data. The ramifications of this vulnerability can include data loss, unauthorized changes to user profiles, and potential exploitation for further attacks.
How To Fix
Minimum fixed version
1.0.9
This is the first release that contains the fix.
composer require in2code/femanager:1.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the femanager extension's functionalities by implementing additional user role checks in your TYPO3 configuration until you can apply the update.
Conclusion
The TYPO3 femanager extension has a significant vulnerability that allows unauthorized users to modify or delete records of other users. Updating to version 1.0.9 or later is crucial to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for in2code/femanager →
FAQ
The femanager extension is a TYPO3 tool that facilitates user management for frontend registrations and profiles.
Versions of femanager prior to 1.0.9 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized modifications or deletions of user records, resulting in data integrity issues and potential exploitation.
It is recommended to regularly check for updates and apply them promptly to ensure your application is secure against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
