GHSA-gwfx-p7mr-f92v: Missing Access Check in TYPO3 CMS
9.1
CVSS Score
3.1
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
6/5/2024
Updated
6/5/2024
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.25 | 6.2.25 |
| typo3/cms | composer | >= 7.6.0, < 7.6.8 | 7.6.8 |
| typo3/cms | composer | >= 8.0.0, < 8.1.1 | 8.1.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability centers on missing access checks in Extbase's request handling. The primary vulnerable function is the Dispatcher::dispatch() method, which directly executes controller actions without authorization in unpatched versions. The FrontendRequestHandler::handleRequest() is also implicated as it initiates the vulnerable request processing flow. These functions would appear in exploitation stack traces as they handle action resolution and execution. The high confidence for Dispatcher::dispatch() aligns with TYPO3's security bulletin describing Extbase's failure to validate() controller/action access during dispatch.