GHSA-3p9x-xxx6-2w4pHighCVSS 8.6

Broken Access Control in 3rd party TYPO3 extension "femanager"

Published
February 2, 2023
Last Modified
February 10, 2023

🔗 CVE IDs covered (1)

CVE-2023-25014 →

📋 Description

A missing access check in the InvitationController allows an unauthenticated user to delete all frontend users.

🎯 Affected products3

  • composer/in2code/femanager:< 5.5.3
  • composer/in2code/femanager:>= 6.0.0, < 6.3.4
  • composer/in2code/femanager:>= 7.0.0, < 7.1.0

🔗 References (3)