GHSA-4576-pgh2-g34jmedium4.3
derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module
The advisory, in context
The existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the RedirectResponse from the $this->redirect() function was never handled.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
derhansen/sf_event_mgt Packagist
Ecosystem versions
From 7.0.0 before 7.4.0
Fixed in 7.4.0
10 explicitly affected versions
7.0.0, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.3.0, 7.3.1, 7.3.2, 7.3.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.0.0",
"7.1.0",
"7.1.1",
"7.1.2",
"7.1.3",
"7.2.0",
"7.3.0",
"7.3.1",
"7.3.2",
"7.3.3"
]
}