Skip to content
OpenAdvisories
High WID-SEC-2023-3144 4 CVEs

TYPO3 Extensions: Mehrere Schwachstellen

Published Dec 12, 2023 · Updated Sep 13, 2026 · Revision 2 · de-DE

Vendor: TYPO3 Product: Extension Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in verschiedenen TYPO3 Extensions ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen und beliebigen Code auszuführen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

  • High 8.8
    CVE-2023-50461

    Configuration Injection in extension "Direct Mail" (direct_mail)

    An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploi…

    TYPO3 direct_mail directmailteam/direct-mail Packagist
  • Medium 5.4
    CVE-2023-50459

    Broken Access Control in extension "femanager"

    An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various fr…

    TYPO3 femanager in2code/femanager Packagist
  • Medium 5.4
    CVE-2023-50460

    An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticat…

    TYPO3 femanager
  • Medium 5.3
    CVE-2023-50462

    Insecure Direct Object Reference in extension "Content Consent" (content_consent)

    An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various conte…

    TYPO3 content_consent t3s/content-consent Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2023-60687, EUVD-2023-60685, EUVD-2023-60688, EUVD-2023-60686

  2. #1

    Initiale Fassung

References