CVE-2023-25013

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://typo3.org/help/security-advisoriesThird Party Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2023-001Patch, Third Party Advisory
https://typo3.org/help/security-advisoriesThird Party Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2023-001Patch, Third Party Advisory

Timeline

Published: Feb 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-250147.5An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in CVE-2023-250156.5Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.CVE-2023-250167.5Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.CVE-2023-250178.1RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to CVE-2023-250185.4RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user priv CVE-2023-250196.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions CVE-2023-250206.1Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.CVE-2023-250214.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions.CVE-2023-250224.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions.CVE-2023-250234.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saleswonder.Biz Webinar ignition plugin <= 2.14.2 versions.CVE-2023-250244.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions.CVE-2023-250258.8Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.