MEDIUM
GHSA-v348-vr4q-fv9p
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
Quick fix
GHSA-v348-vr4q-fv9p — evoweb/sf-register: upgrade to the fixed version with the command below.
composer require evoweb/sf-register:^14.0.2Details
The `create` and `edit` flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/evoweb/sf-register
Introduced in:
14.0.0Fixed in: 14.0.2Fix
composer require evoweb/sf-register:^14.0.2Packagist/evoweb/sf-register
Introduced in:
0Fixed in: 13.2.4Fix
composer require evoweb/sf-register:^13.2.4