TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)
Impact
An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 3.0.0 before 3.5.2Ecosystem versions | 3.5.2 |
| Earlier releases before 2.2.1Ecosystem versions | 2.2.1 |
Version evidence: OSV · GHSA-7gpw-frph-fwrg
View original version evidence (1 explicit versions)
Original source description
An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2022-47407
- Patch github.com/bihor/fp_masterquiz/commit/f6f1baa594334c629637f5b87478ae31cdcaaa09
- Patch github.com/bihor/fp_masterquiz/commit/fce4ec64600df3f38cacc9a86ba2bd063a51e140
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/fixpunkt/fp-masterquiz/CVE-2022-47407.yaml
- Security advisory typo3.org/security/advisory/typo3-ext-sa-2022-018