Extension "femanager" vulnerabilities
3 known vulnerabilities in Extension "femanager" from TYPO3. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.3 High severity
Extension "femanager": Missing Authorization
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing front
- 8.2 High severity
Extension "femanager": Authorization Bypass Through User-Controlled Key
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, dat
- 8.3 High severity
Extension "femanager": Incorrect Authorization
The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pendi