VulnerabilityDeferred

CVE-2024-38874

Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

MEDIUM 5.4EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-693
Source: cve@mitre.org

References

https://typo3.org/security/advisory/typo3-ext-sa-2024-003
https://typo3.org/security/advisory/typo3-ext-sa-2024-003

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.