Description (CNA)
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TYPO3 / Extension "Frontend User Registration" | affected 14.0.0 before 14.0.2; affected 0 before 13.2.4 |
CWE
CWE-915, CWE-639
References
ADP enrichment
No English description supplied.
No references supplied.