-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions missing access checks in the management plugin for activation/deletion operations. In TYPO3 architecture, these operations would typically be handled by controller actions. The combination of user-controlled event IDs (CWE-639) and lack of permission verification in these CRUD operations matches the described attack pattern. The high confidence comes from the direct correlation between the described vulnerability type (IDOR in management plugin) and standard TYPO3 extension patterns where controller actions handle such operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jweiland/events2 | composer | < 8.3.8 | 8.3.8 |
| jweiland/events2 | composer | >= 9.0.0, < 9.0.6 | 9.0.6 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report