medium5.3
CVE-2023-50462
Insecure Direct Object Reference in extension "Content Consent" (content_consent)
Impact
The extension fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) vulnerability with the potential to expose internal content elements.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | t3s/content-consent | >= 2.0.0, < 2.0.2 | 2.0.2 |
Affected products
| Product | Affected versions |
|---|---|
| Content Consent (Aka Content Consent) Extension | through 2.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.