CVE-2023-50462: Insecure Direct Object Reference in extension "Content Consent" (content_consent)
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
-
Published
12/13/2023
Updated
12/13/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| t3s/content-consent | composer | >= 2.0.0, < 2.0.2 | 2.0.2 |
| t3s/content-consent | composer | < 1.0.3 | 1.0.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing authorization checks when processing content element display requests. In TYPO3 MVC architecture:
- Controller actions handle parameter input and initiate rendering
- Repository methods perform database lookups
While no patch diffs are available, the advisory explicitly states the lack of permission verification for content element identifiers. This indicates:
- The controller action handling content display (likely showAction) accepted user input without authorization
- The repository method retrieving elements (findByUid) was called with this untrusted input
These functions would appear in runtime profiles when processing malicious requests as they directly handle the vulnerable parameter flow. Confidence is medium due to inference from advisory text rather than explicit patch analysis.