SB2020090307 - Multiple vulnerabilities in Event management and registration (sf_event_mgt) extension for TYPO3

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2020-25026)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a missing access check in the backend module. A remote autuenticated attacker can export participant data for events which the user does not have access to and gain unauthorized access to sensitive information on the system.

2) Improper access control (CVE-ID: CVE-2020-25026)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the backend module. A remote authenticated attacker can send emails to event participants for events which the user does not have access to, bypass implemented security restrictions and gain unauthorized access to the application.

Remediation

Install update from vendor's website.

References

• https://typo3.org/help/security-advisories
• https://typo3.org/security/advisory/typo3-ext-sa-2020-017