CVE-2024-38874: 
PHP vulnerability analysis and mitigation

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users (TYPO3 Advisory).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) with a CVSS v3.1 score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The issue stems from improper access control mechanisms in the management plugin, allowing unauthorized access to event management functions (TYPO3 Advisory).

The vulnerability allows unauthenticated users to activate or delete various events in the system, potentially disrupting event management and compromising data integrity (TYPO3 Advisory).

The vulnerability can be exploited remotely by unauthenticated users through the management plugin. The attack complexity is considered low, requiring only basic access to the system's event management functionality (TYPO3 Advisory).

Updated versions 8.3.8 and 9.0.6 have been released to address this vulnerability. Users are advised to update the extension as soon as possible through the TYPO3 extension manager, packagist, or by downloading directly from the TYPO3 extension repository (TYPO3 Advisory).