TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
The advisory, in context
The create and edit flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 14.0.0 before 14.0.2
Fixed in 14.0.2
2 explicitly affected versions
14.0.0, 14.0.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"14.0.0",
"14.0.1"
]
}Earlier releases before 13.2.4
Fixed in 13.2.4
50 explicitly affected versions
10.0.0, 10.0.1, 10.0.2, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.2.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 12.0.0, 12.0.1, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.2.0, 13.2.1, 13.2.2, 13.2.3, 6.2.9, 8.7.0, 8.7.1, 8.7.2, 8.7.3, 8.8.0, 8.8.1, 8.8.2, 8.8.3, 8.8.4, 8.8.5, 8.8.6, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.4.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.2.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.1",
"10.0.2",
"10.1.0",
"10.1.1",
"10.1.2",
"10.1.3",
"10.1.4",
"10.1.5",
"10.1.6",
"10.1.7",
"10.2.0",
"11.0.0",
"11.1.0",
"11.1.1",
"11.1.2",
"11.1.3",
"11.1.4",
"11.1.5",
"12.0.0",
"12.0.1",
"13.0.0",
"13.0.1",
"13.1.0",
"13.1.1",
"13.1.2",
"13.1.3",
"13.1.4",
"13.2.0",
"13.2.1",
"13.2.2",
"13.2.3",
"6.2.9",
"8.7.0",
"8.7.1",
"8.7.2",
"8.7.3",
"8.8.0",
"8.8.1",
"8.8.2",
"8.8.3",
"8.8.4",
"8.8.5",
"8.8.6",
"9.0.0",
"9.1.0",
"9.2.0",
"9.3.0",
"9.4.0",
"9.4.1"
]
}