CVE-2023-50462
Quick assessment
Affected
TYPO3 content_consent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 TYPO3 的 content_consent（又称 Content Consent）插件中（版本 2.0.1 及之前），发现了一个安全漏洞。该插件未能验证指定的内容元素标识符是否被插件允许。这使得未经身份验证的用户能够显示各种内容元素，从而引发不安全的直接对象引用（IDOR，Insecure Direct Object Reference）问题，可能导致内部内容元素被暴露。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-50462
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TYPO3 | content_consent | 0 ~ 1.0.3 | - |
|
II. Public POCs for CVE-2023-50462
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-50462
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-50462 (1)
Same Patch Batch · TYPO3 · 2026-09-14 · 5 CVEs total
| CVE-2023-50461 | 8.8 HIGH | TYPO3 Direct Mail 9.5.1 配置注入导致代码执行 |
| CVE-2023-50460 | 5.4 MEDIUM | TYPO3 femanager 7.x 授权用户操作任意前端用户 |
| CVE-2023-50459 | 5.4 MEDIUM | TYPO3 femanager 7.x<7.2.3 前端用户权限检查缺失 |
| CVE-2023-45023 | 4.2 MEDIUM | TYPO3 femanager 7<7.2.2 邀请功能访问控制漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2023-50462
No comments yet