Executive brief
The femanager extension for TYPO3 is a frontend user management plugin that allows website administrators to manage user registration and group assignments. An unauthenticated attacker can bypass access controls to create new frontend user accounts and assign them to protected user groups, potentially gaining unauthorized access to restricted content or features depending on how the site is configured.
Technical details
The vulnerability is a broken access control flaw (CWE-284) in the invitation component of the femanager extension versions 7.0.0 through 7.2.1. The extension fails to properly validate permissions before allowing users to perform invitation-related operations. No authentication is required to exploit this vulnerability, and it can be triggered over the network without user interaction. An attacker can create frontend user accounts and assign them to configured frontend groups, effectively bypassing the intended access control mechanism. The vulnerability has been patched in version 7.2.2, which is available from the TYPO3 extension manager and Packagist.
Affected products
- in2code femanager 7.0.0 - 7.2.1
Timeline
- 2023-10-04: disclosed
- 2023-10-04: patched: version 7.2.2 released