Extension Telephone Directory
Monthly
Unauthenticated record tampering in the TYPO3 Telephone Directory extension allows any visitor who can identify an employee UID to overwrite that employee's data via a direct POST request, bypassing HMAC-based edit-link authorization entirely. The extension enforces HMAC validation only at the form-render step, leaving the persistence action unprotected under CWE-862 (Missing Authorization). With a CVSS 4.0 score of 8.7 and an attack profile of network-accessible, no-privilege, no-interaction, no public exploit has been identified at time of analysis, but the attack requires no authentication and minimal attacker capability.
Unauthenticated record tampering in the TYPO3 Telephone Directory extension allows any visitor who can identify an employee UID to overwrite that employee's data via a direct POST request, bypassing HMAC-based edit-link authorization entirely. The extension enforces HMAC validation only at the form-render step, leaving the persistence action unprotected under CWE-862 (Missing Authorization). With a CVSS 4.0 score of 8.7 and an attack profile of network-accessible, no-privilege, no-interaction, no public exploit has been identified at time of analysis, but the attack requires no authentication and minimal attacker capability.