CVE-2023-25013

Summary

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://typo3.org/help/security-advisories
• https://typo3.org/security/advisory/typo3-ext-sa-2023-001

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://typo3.org/help/security-advisories
• https://typo3.org/security/advisory/typo3-ext-sa-2023-001

• ←Previous
• Next→