Multiple vulnerabilities in Event management and registration (sf_event_mgt) extension for TYPO3

Published: 2020-09-03

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-25026
CWE-ID	CWE-200 CWE-284
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Event management and registration Web applications / Modules and components for CMS
Vendor	Torben Hansen

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU46245

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25026

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a missing access check in the backend module. A remote autuenticated attacker can export participant data for events which the user does not have access to and gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Event management and registration: 0.5.0 - 5.1.0

External links

http://typo3.org/help/security-advisories
http://typo3.org/security/advisory/typo3-ext-sa-2020-017

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU46246

Risk: Medium

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]