What is GHSA-j8cw-ppmv-wj85?

GHSA-j8cw-ppmv-wj85 is a security advisory published by GitHub Security Advisories with Medium severity. Insecure Direct Object Reference in extension "Content Consent" (content_consent)

Which CVE IDs does GHSA-j8cw-ppmv-wj85 cover?

GHSA-j8cw-ppmv-wj85 covers the following CVE IDs: CVE-2023-50462. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j8cw-ppmv-wj85?

GHSA-j8cw-ppmv-wj85 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-j8cw-ppmv-wj85?

GHSA-j8cw-ppmv-wj85 affects 2 products, including: composer/t3s/content-consent:\u003e= 2.0.0, \u003c 2.0.2; composer/t3s/content-consent:\u003c 1.0.3.

GHSA-j8cw-ppmv-wj85MediumCVSS 5.3

Insecure Direct Object Reference in extension "Content Consent" (content_consent)

Vendor

GitHub Security Advisories

Published

December 13, 2023

Last Modified

December 13, 2023

🔗 CVE IDs covered (1)

CVE-2023-50462 →

📋 Description

The extension fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) vulnerability with the potential to expose internal content elements.

🎯 Affected products2

composer/t3s/content-consent:>= 2.0.0, < 2.0.2
composer/t3s/content-consent:< 1.0.3

🔗 References (3)

https://github.com/FriendsOfPHP/security-advisories/blob/master/t3s/content-consent/CVE-2023-50462.yaml
https://typo3.org/security/advisory/typo3-ext-sa-2023-009
https://github.com/advisories/GHSA-j8cw-ppmv-wj85