Information Disclosure in TYPO3 Frontend User Extension

Executive Summary

This vulnerability is an Information Disclosure issue in the femanager extension for TYPO3. It allows any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data by supplying an arbitrary user ID. The extension fails to verify if the requested user record matches the logged-in user or configured target, exposing sensitive data like name, email, date of birth, and address.

Useful 0 Not Useful 0

Detection Guidance

Check if the femanager extension is installed and its version is below the patched versions (6.4.5, 7.5.5, 8.4.2, or 13.3.5). Inspect network traffic for requests to Detail or List plugin endpoints that include arbitrary user IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive user data, including personal information such as names, emails, dates of birth, and addresses. Attackers could exploit it to gather private details about users without their consent, potentially leading to identity theft, privacy violations, or further targeted attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing personal user data without authorization. GDPR requires strict controls to protect personal data, while HIPAA mandates safeguards for protected health information. A breach like this could result in legal penalties, fines, and reputational damage due to non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update the femanager extension to the latest patched version (6.4.5, 7.5.5, 8.4.2, or 13.3.5) immediately. If updating is not possible, disable the Detail and List plugins or restrict access to them.

Useful 0 Not Useful 0