{"id":"GHSA-93j4-v838-8767","aliases":["CVE-2023-45023"],"title":"TYPO3 extension femanager Broken Access Control vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.","severity":"medium","score":null,"published":"2023-10-04T17:57:18.000Z","modified":"2024-11-28T05:44:52.248Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"in2code/femanager","sources":[{"name":"OSV · GHSA-93j4-v838-8767","url":"https://osv.dev/vulnerability/GHSA-93j4-v838-8767"}],"ranges":[{"events":[{"introduced":"7.0.0"},{"fixed":"7.2.2"}],"type":"ECOSYSTEM"}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.2.0","7.2.1"],"fixed":["7.2.2"]}],"sourceAffected":[],"references":["https://github.com/in2code-de/femanager/commit/cc5f2893613a6b3fd2677c457574ab587a0862ca","https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-45023.yaml","https://github.com/in2code-de/femanager","https://github.com/in2code-de/femanager/releases/tag/7.2.2","https://typo3.org/security/advisory/typo3-ext-sa-2023-008"],"sources":[{"name":"OSV","id":"GHSA-93j4-v838-8767","modified":"2024-11-28T05:44:52.248341Z","url":"https://osv.dev/vulnerability/GHSA-93j4-v838-8767"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:45:31.439Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}