Improper Authorization Affecting in2code/femanager package, versions >=7.0.0, <7.2.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-IN2CODEFEMANAGER-5932094
- published 5 Oct 2023
- disclosed 4 Oct 2023
- credit Steffen Keuper
Introduced: 4 Oct 2023
CVE-2023-45023 Open this link in a new tabHow to fix?
Upgrade in2code/femanager to version 7.2.2 or higher.
Overview
in2code/femanager is a Modern TYPO3 Frontend User Registration.
Affected versions of this package are vulnerable to Improper Authorization. The extension fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.
Note:
The issue is only exploitable, if the invitation component of the extension is configured and used on the website.
References
CVSS Scores
version 3.1