MEDIUM4.3

GHSA-cv9j-78f7-w6v9

Incorrect Authorization in TYPO3 extension

Quick fix

GHSA-cv9j-78f7-w6v9 — localizationteam/l10nmgr: upgrade to the fixed version with the command below.

composer require localizationteam/l10nmgr:^7.4.0

Details

The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/localizationteam/l10nmgr

Introduced in: 0Fixed in: 7.4.0

Fixcomposer require localizationteam/l10nmgr:^7.4.0

Packagist/localizationteam/l10nmgr

Introduced in: 8.0.0Fixed in: 8.7.0

Fixcomposer require localizationteam/l10nmgr:^8.7.0

Packagist/localizationteam/l10nmgr

Introduced in: 9.0.0Fixed in: 9.2.0

Fixcomposer require localizationteam/l10nmgr:^9.2.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-25025[ADVISORY]
https://typo3.org/help/security-advisories[WEB]
https://typo3.org/security/advisory/typo3-ext-sa-2020-016[WEB]