CVE-2022-44543
First published: Wed Nov 02 2022(Updated: )
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/in2code/femanager | >=7.0.0<7.0.1>=6.0.0<6.3.3<5.5.2 | |
| In2code Femanager | <5.5.2 | |
| In2code Femanager | >=6.0.0<6.3.3 | |
| In2code Femanager | =7.0.0 | |
| composer/in2code/femanager | <5.5.2 | 5.5.2 |
| composer/in2code/femanager | >=6.0.0<6.3.3 | 6.3.3 |
| composer/in2code/femanager | >=7.0.0<7.0.1 | 7.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://typo3.org/security/advisory/typo3-ext-sa-2022-015
- https://typo3.org/help/security-advisories
- https://github.com/in2code-de/femanager/commit/827edbc767b1cb6c0cb77d82e46b88fea3b22ad9
- https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2022-44543.yaml
- https://github.com/in2code-de/femanager/releases/tag/5.5.2
- https://github.com/in2code-de/femanager/releases/tag/6.3.3
- https://github.com/in2code-de/femanager/releases/tag/7.0.1
- https://nvd.nist.gov/vuln/detail/CVE-2022-44543
- https://github.com/advisories/GHSA-59m9-p6cm-94q5 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-44543?
CVE-2022-44543 is classified as a critical vulnerability affecting the femanager extension for TYPO3.
How do I fix CVE-2022-44543?
To fix CVE-2022-44543, update the femanager extension to version 5.5.2, 6.3.3, or 7.0.1.
Which versions of femanager are affected by CVE-2022-44543?
CVE-2022-44543 affects femanager versions before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1.
What type of vulnerability is CVE-2022-44543?
CVE-2022-44543 is a user authentication vulnerability that allows unauthorized creation of frontend users in restricted groups.
Is there a workaround for CVE-2022-44543?
There is no official workaround for CVE-2022-44543; the only solution is to update to the fixed versions.
- collector/friends-of-php
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-59m9-p6cm-94q5
- alias/CVE-2022-44543
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/event
- agent/description
- agent/trending
- agent/tags
- agent/source
- package-manager/composer
- vendor/in2code
- canonical/in2code femanager
- version/in2code femanager/6.0.0
- version/in2code femanager/7.0.0