A missing access check in the InvitationController allows an unauthenticated user with a valid invitation link to set the password of all frontend users.
GSA_kwCzR0hTQS1tbTh2LXdtcXgtOGgyas4AAxVo
Broken Access Control in 3rd party TYPO3 extension "femanager"
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:in2code/femanager | >= 7.0.0, < 7.1.0, >= 6.0.0, < 6.3.4, < 5.5.3 | 7.1.0, 6.3.4, 5.5.3 | |
Affected Version RangesAll affected versions2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.3.0, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 5.0.0, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.3.1, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 7.0.0, 7.0.1 All unaffected versions5.5.3, 5.5.4, 5.5.5, 6.3.4, 6.3.5, 6.3.6, 6.4.0, 6.4.1, 6.4.2, 7.1.0, 7.1.1, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.5.0, 7.5.1, 7.5.2, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.2.2, 8.3.0 |
|||