medium4.3
CVE-2024-24751
derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module
Impact
The existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | derhansen/sf_event_mgt | >= 7.0.0, < 7.4.0 | 7.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Derhansen | Event Management And Registration | Version 7.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/derhansen/sf_event_mgt/commit/a08c2cd48695c07e462d15eeb70434ddc0206e4c
- https://github.com/derhansen/sf_event_mgt/security/advisories/GHSA-4576-pgh2-g34j
- https://github.com/advisories/GHSA-4576-pgh2-g34j
- https://nvd.nist.gov/vuln/detail/CVE-2024-24751