Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-45023
CVE-2023-45023:
PHP vulnerability analysis and mitigation
Overview
A vulnerability was discovered in the TYPO3 extension 'femanager' (CVE-2023-45023) that was disclosed on October 4, 2023. The vulnerability affects versions 7.0.0 through 7.2.1 of the extension and is classified as a Broken Access Control issue with medium severity. The affected package is identified as 'in2code/femanager' in the Composer package management system (TYPO3 Advisory, GitHub Advisory).
Technical details
The vulnerability stems from the extension's failure to properly check access permissions for the invitation component. The issue is specifically related to missing permission checks in the invitation controlling functionality. This security flaw has been assigned a CVSS score suggesting medium severity with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C and is categorized under CWE-284 (Broken Access Control) (TYPO3 Advisory).
Impact
When exploited, this vulnerability allows remote users to create frontend user accounts with access to configured frontend groups, potentially leading to unauthorized access. The impact is contingent on the configuration of the plugin, specifically affecting websites where the invitation component of the extension is configured and actively used (TYPO3 Advisory).
Mitigation and workarounds
The vulnerability has been patched in version 7.2.2 of the femanager extension. Users are strongly advised to update to this version as soon as possible. The fix can be obtained through the TYPO3 extension manager, Packagist, or by downloading directly from the TYPO3 extension repository (TYPO3 Advisory, GitHub Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management