VDB
Sign up
MEDIUM5.3

GHSA-xxwr-wv9g-7jw3

The femanager TYPO3 extension allows Insecure Direct Object Reference

Quick fix

GHSA-xxwr-wv9g-7jw3 — in2code/femanager: upgrade to the fixed version with the command below.

composer require in2code/femanager:^8.2.2

Details

Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/in2code/femanager
Introduced in: 8.0.0Fixed in: 8.2.2
Fixcomposer require in2code/femanager:^8.2.2
Packagist/in2code/femanager
Introduced in: 7.0.0Fixed in: 7.4.2
Fixcomposer require in2code/femanager:^7.4.2
Packagist/in2code/femanager
Introduced in: 6.0.0Fixed in: 6.4.1
Fixcomposer require in2code/femanager:^6.4.1
Packagist/in2code/femanager
Introduced in: 5.5.0Fixed in: 5.5.5
Fixcomposer require in2code/femanager:^5.5.5

References