Access Restriction Bypass Affecting in2code/femanager package, versions <5.5.3 >=6.0.0, <6.3.4 >=7.0.0, <7.1.0
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.07% (31st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-IN2CODEFEMANAGER-3266773
- published 2 Feb 2023
- disclosed 2 Feb 2023
- credit Stefan Busemann
Introduced: 2 Feb 2023
CVE-2023-25013 Open this link in a new tabHow to fix?
Upgrade in2code/femanager to version 5.5.3, 6.3.4, 7.1.0 or higher.
Overview
in2code/femanager is a Modern TYPO3 Frontend User Registration.
Affected versions of this package are vulnerable to Access Restriction Bypass due to improper access validation in the InvitationController. Exploiting this vulnerability allows an unauthenticated user with a valid invitation link to set the password or delete frontend users.
References
CVSS Scores
version 3.1