VulnerabilityModified
CVE-2022-44543
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form).
MEDIUM 5.3EPSS 0.60%
Does this matter?
Lower severity and a low EPSS score (0.60%). Track it; it rarely justifies an emergency change on its own.
Description
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.60% probability · 47th percentile
- CISA KEV
- Not listed
- Affected
- in2code/femanager
- Source
- cve@mitre.org
References
- https://typo3.org/help/security-advisoriesVendor Advisory
- https://typo3.org/security/advisory/typo3-ext-sa-2022-015Vendor Advisory
- https://typo3.org/help/security-advisoriesVendor Advisory
- https://typo3.org/security/advisory/typo3-ext-sa-2022-015Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.