Extension Event Management And Registration
Monthly
Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the `disableOverrideDemand` plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. No public exploit code has been identified at time of analysis, and CVSS 4.0 scores this at 6.3 Medium with low confidentiality impact and no integrity or availability consequence.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the `disableOverrideDemand` plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. No public exploit code has been identified at time of analysis, and CVSS 4.0 scores this at 6.3 Medium with low confidentiality impact and no integrity or availability consequence.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.