CVE-2024-24751

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247526.5Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInter CVE-2024-247536.5Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multip CVE-2024-247549.8Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInter CVE-2024-247555.3discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-CVE-2024-247567.5Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be re CVE-2024-247579.8open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when worki CVE-2024-247584.5Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but CVE-2024-247599.1MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the s CVE-2024-24764.3The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane CVE-2024-247607.3mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified CVE-2024-247617.5Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, publi CVE-2024-247627.5`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse t