CVE-2023-50462: 
PHP vulnerability analysis and mitigation

CVE-2023-50462 is a security vulnerability discovered in the TYPO3 extension 'Content Consent' (content_consent). The vulnerability was disclosed on December 13, 2023, affecting versions 1.0.2 and below, as well as versions 2.0.0 through 2.0.1 of the extension (TYPO3 Advisory).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue with a CVSS v3.1 base score of 5.3 (Moderate severity). The vulnerability has a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating it can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and has a limited impact on confidentiality (GitHub Advisory).

The vulnerability allows an unauthenticated user to display various content elements that they shouldn't have access to. This could potentially expose internal content elements that were meant to be restricted, leading to unauthorized information disclosure (TYPO3 Advisory).

The vulnerability can be exploited by an unauthenticated attacker remotely, as the extension fails to verify whether a specified content element identifier is permitted by the plugin. No special privileges or user interaction is required to exploit this vulnerability (GitHub Advisory).

The vulnerability has been patched in versions 1.0.3 and 2.0.2 of the extension. Users are advised to update to these patched versions as soon as possible. The updated versions can be obtained through the TYPO3 extension manager, packagist, or downloaded directly from the TYPO3 extension repository (TYPO3 Advisory).