CVE-2024-38874 - Vulnerability Details - OpenCVE

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Typo3	Events2

No data.

No data.

References

Link	Providers
https://typo3.org/security/advisory/typo3-ext-sa-2024-003

History

Mon, 24 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Typo3 Typo3 events2
CPEs		cpe:2.3:a:typo3:events2:::::::: cpe:2.3:a:typo3:events2:9.0:::::::*
Vendors & Products		Typo3 Typo3 events2
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 24 Mar 2025 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-693

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-06-21T00:00:00.000Z

Updated: 2025-03-24T21:08:46.110Z

Reserved: 2024-06-21T00:00:00.000Z

Link: CVE-2024-38874

Vulnrichment

Updated: 2024-08-02T04:19:20.500Z

NVD

Status : Awaiting Analysis

Published: 2024-06-21T07:15:10.200

Modified: 2025-03-24T21:15:17.203

Link: CVE-2024-38874

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-38874", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-03-24T21:08:46.110Z", "dateReserved": "2024-06-21T00:00:00.000Z", "datePublished": "2024-06-21T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-21T06:21:23.518Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-003"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-693", "lang": "en", "description": "CWE-693 Protection Mechanism Failure"}]}], "affected": [{"vendor": "typo3", "product": "events2", "cpes": ["cpe:2.3:a:typo3:events2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.3.8", "versionType": "custom"}]}, {"vendor": "typo3", "product": "events2", "cpes": ["cpe:2.3:a:typo3:events2:9.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "9.0", "status": "affected", "lessThan": "9.0.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-21T16:22:57.997573Z", "id": "CVE-2024-38874", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T21:08:46.110Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.500Z"}, "title": "CVE Program Container", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-003", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-003", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.500Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38874", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-21T16:22:57.997573Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:typo3:events2:*:*:*:*:*:*:*:*"], "vendor": "typo3", "product": "events2", "versions": [{"status": "affected", "version": "0", "lessThan": "8.3.8", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:typo3:events2:9.0:*:*:*:*:*:*:*"], "vendor": "typo3", "product": "events2", "versions": [{"status": "affected", "version": "9.0", "lessThan": "9.0.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T16:26:13.044Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-003"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-21T06:21:23.518Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38874", "state": "PUBLISHED", "dateUpdated": "2025-03-24T21:08:46.110Z", "dateReserved": "2024-06-21T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-06-21T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}