MEDIUM

GHSA-m646-h2pw-56h4

Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords

Quick fix

GHSA-m646-h2pw-56h4 — sjbr/sr-feuser-register: upgrade to the fixed version with the command below.

composer require sjbr/sr-feuser-register:^2.6.2

Details

The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/sjbr/sr-feuser-register

Introduced in: 0Fixed in: 2.6.2

Fixcomposer require sjbr/sr-feuser-register:^2.6.2

References

https://nvd.nist.gov/vuln/detail/CVE-2012-5890[ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/80145[WEB]
https://github.com/TYPO3-extensions/sr_feuser_register[PACKAGE]
https://web.archive.org/web/20120715071728/http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-002[WEB]
http://forge.typo3.org/projects/extension-sr_feuser_register/repository/entry/trunk/ChangeLog[WEB]
http://forge.typo3.org/projects/extension-sr_feuser_register/repository/revisions/58720[WEB]