CVE-2023-25013 in femanager Extension
Summary
by MITRE • 02/02/2023
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/05/2025
The vulnerability identified as CVE-2023-25013 represents a critical access control flaw within the femanager extension for TYPO3 CMS systems. This issue affects multiple version ranges including femanager versions prior to 5.5.3, 6.x versions before 6.3.4, and 7.x versions before 7.1.0. The core problem lies in the InvitationController component where proper authentication and authorization checks are completely absent, creating a significant security gap that allows unauthorized actors to exploit the system's user management functionality.
The technical flaw manifests as a missing access control mechanism in the InvitationController which is responsible for handling user invitation and password reset operations. When an unauthenticated user accesses specific endpoints within this controller, they can manipulate the system to set passwords for any frontend user account without proper verification of their privileges. This represents a classic authorization bypass vulnerability that falls under CWE-285, which specifically addresses insufficient authorization issues in software applications. The vulnerability operates at the application layer where the system fails to properly validate whether the requesting entity has legitimate authority to perform the requested action.
The operational impact of this vulnerability is severe and far-reaching for organizations utilizing affected TYPO3 installations. An attacker who discovers this vulnerability can potentially compromise all frontend user accounts within the system, leading to unauthorized access to user data, account takeovers, and potential lateral movement within the application environment. This flaw enables attackers to gain persistent access to user accounts, which could then be leveraged for further exploitation such as data exfiltration, privilege escalation, or as a foothold for broader network infiltration activities. The vulnerability directly violates fundamental security principles of least privilege and proper access control enforcement, making it particularly dangerous in multi-user environments where frontend users may have access to sensitive information or system resources.
Organizations affected by this vulnerability should immediately implement the recommended mitigations including upgrading to the patched versions of the femanager extension as specified in the CVE details. The ATT&CK framework categorizes this type of vulnerability under T1078 Valid Accounts and T1566 Phishing, as it enables attackers to establish persistent access through compromised user credentials. Additionally, system administrators should implement network segmentation controls, monitor for unauthorized access attempts, and conduct thorough security audits of all TYPO3 extensions to identify similar access control gaps. The vulnerability also highlights the importance of implementing proper input validation and access control mechanisms at all levels of application development, particularly in components that handle user management functions. Organizations should also consider implementing additional security measures such as rate limiting on password reset functions and enhanced monitoring of user account modifications to detect and respond to potential exploitation attempts.