Broken Access Control in 3rd party TYPO3 extension "femanager"
The advisory, in context
A missing access check in the InvitationController allows an unauthenticated user with a valid invitation link to set the password of all frontend users.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 5.5.3
Fixed in 5.5.3
38 explicitly affected versions
2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.3.0, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 5.0.0, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.3.1, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0",
"2.5.1",
"2.6.0",
"2.6.1",
"2.6.2",
"2.7.0",
"3.0.0",
"3.0.1",
"3.0.2",
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3",
"3.2.0",
"3.3.0",
"4.0.0",
"4.0.1",
"4.0.2",
"4.1.0",
"4.1.1",
"4.2.0",
"4.2.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"5.0.0",
"5.1.0",
"5.1.1",
"5.2.0",
"5.3.0",
"5.3.1",
"5.4.0",
"5.4.1",
"5.4.2",
"5.5.0",
"5.5.1",
"5.5.2"
]
}From 6.0.0 before 6.3.4
Fixed in 6.3.4
11 explicitly affected versions
6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.3.0, 6.3.1, 6.3.2, 6.3.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.3.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.0",
"6.0.1",
"6.1.0",
"6.1.1",
"6.1.2",
"6.2.0",
"6.2.1",
"6.3.0",
"6.3.1",
"6.3.2",
"6.3.3"
]
}From 7.0.0 before 7.1.0
Fixed in 7.1.0
2 explicitly affected versions
7.0.0, 7.0.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.0.0",
"7.0.1"
]
}