The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3…
Priority LOW 25Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
Why it matters now
EPSS 0.00603 49th percentileScored 2026-11-07
Fix Fixed in2code/femanager (Packagist): 7.0.1, 6.3.3, 5.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | in2code/femanager (Packagist) | 7.0.0 to before 7.0.1 | 7.0.1 | Patch available | GHSA-59m9-p6cm-94q5 |
| — | in2code/femanager (Packagist) | 6.0.0 to before 6.3.3 | 6.3.3 | Patch available | GHSA-59m9-p6cm-94q5 |
| — | in2code/femanager (Packagist) | before 5.5.2 | 5.5.2 | Patch available | GHSA-59m9-p6cm-94q5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- in2code/femanager (Packagist) Vendor— Affected 7.0.0 to before 7.0.1 Fixed in 7.0.1 Patch available GHSA-59m9-p6cm-94q5
- in2code/femanager (Packagist) Vendor— Affected 6.0.0 to before 6.3.3 Fixed in 6.3.3 Patch available GHSA-59m9-p6cm-94q5
- in2code/femanager (Packagist) Vendor— Affected before 5.5.2 Fixed in 5.5.2 Patch available GHSA-59m9-p6cm-94q5
Remediation
- Fix · GHSA-59m9-p6cm-94q5 in2code/femanager (Packagist) Fixed in 7.0.1 Advisory →
- Fix · GHSA-59m9-p6cm-94q5 in2code/femanager (Packagist) Fixed in 6.3.3 Advisory →
- Fix · GHSA-59m9-p6cm-94q5 in2code/femanager (Packagist) Fixed in 5.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-44543
- 2026-10-03 Alias added: GHSA-59m9-p6cm-94q5
References
Advisory 3
Other 6
- https://github.com/in2code-de/femanager/commit/827edbc767b1cb6c0cb77d82e46b88fea3b22ad9
- https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2022-44543.yaml
- https://github.com/in2code-de/femanager
- https://github.com/in2code-de/femanager/releases/tag/5.5.2
- https://github.com/in2code-de/femanager/releases/tag/6.3.3
- https://github.com/in2code-de/femanager/releases/tag/7.0.1
More In2code Femanager vulnerabilities
- TI-2023-10486 An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and… CVSS 3.1HIGH 8.6
- TI-2023-10487 An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and… CVSS 3.1HIGH 8.6
- TI-2014-05173 The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or… CVSS 2.0MEDIUM 6.4
- TI-2021-14908 The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2022-44543 · CVE Program
- CVE-2022-44543 · NVD
- FIRST EPSS
- GHSA-59m9-p6cm-94q5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences