GHSA-93j4-v838-8767

Suggest an improvement
Source
https://github.com/advisories/GHSA-93j4-v838-8767
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-93j4-v838-8767/GHSA-93j4-v838-8767.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-93j4-v838-8767
Aliases
  • CVE-2023-45023
Published
2023-10-04T17:57:18Z
Modified
2024-11-28T05:44:52Z
Summary
TYPO3 extension femanager Broken Access Control vulnerability
Details

femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-04T17:57:18Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

Packagist / in2code/femanager

Package

Name
in2code/femanager
Purl
pkg:composer/in2code/femanager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.0.0
Fixed
7.2.2

Affected versions

7.*
7.0.0
7.0.1
7.1.0
7.1.1
7.2.0
7.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-93j4-v838-8767/GHSA-93j4-v838-8767.json"