CVE-2014-6292

Vulnerability

The TYPO3 extension femanager versions 1.0.8 and below fail to properly check access rights, allowing a logged-in frontend user to modify or delete records belonging to other frontend users [1][2]. The vulnerability is classified as privilege escalation with a severity of High [1][2].

Exploitation

An attacker must be a logged-in frontend user (requires authentication) and then exploit the missing access check to manipulate records of other users [1][2]. The exact vector is not fully specified in the references, but the vulnerability is reachable from the frontend without requiring administrative privileges [1][2].

Impact

Successful exploitation allows the attacker to modify or delete user records of other frontend users [1][2]. This can lead to unauthorized changes to user data, potentially causing loss of data integrity and confidentiality for affected users. The attacker does not gain full administrative control but can impact other users' data [1][2].

Mitigation

The vulnerability is fixed in femanager version 1.0.9, which was released on February 12, 2014, as part of the TYPO3 extension security bulletin [1][2]. Users of affected versions (1.0.8 and below) should update to 1.0.9 or later. No workaround is described. The extension author provided the fix in a timely manner [1][2].