What’s Vulnerable › Vulnerabilities

CVE-2024-24751: Broken Access Control in Backend Module in sf_event_mgt

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-13 · updated 2026-06-17
• Weakness: CWE-284

Description

sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• derhansen sf_event_mgt: 7.0.0

References

• https://github.com/derhansen/sf_event_mgt/commit/a08c2cd48695c07e462d15eeb70434ddc0206e4c
• https://github.com/derhansen/sf_event_mgt/security/advisories/GHSA-4576-pgh2-g34j
• https://github.com/derhansen/sf_event_mgt/commit/a08c2cd48695c07e462d15eeb70434ddc0206e4c
• https://github.com/derhansen/sf_event_mgt/security/advisories/GHSA-4576-pgh2-g34j

Get alerted when CVE-2024-24751 or the next vulnerability affects your stack