MEDIUM4.3

GHSA-4576-pgh2-g34j

derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module

Quick fix

GHSA-4576-pgh2-g34j — derhansen/sf_event_mgt: upgrade to the fixed version with the command below.

composer require derhansen/sf_event_mgt:^7.4.0

Details

The existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/derhansen/sf_event_mgt

Introduced in: 7.0.0Fixed in: 7.4.0

Fixcomposer require derhansen/sf_event_mgt:^7.4.0

References

https://github.com/derhansen/sf_event_mgt/security/advisories/GHSA-4576-pgh2-g34j[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2024-24751[ADVISORY]
https://github.com/derhansen/sf_event_mgt/commit/a08c2cd48695c07e462d15eeb70434ddc0206e4c[WEB]
https://github.com/derhansen/sf_event_mgt[PACKAGE]