CVE-2024-38874

—

CVSS 3.1

5.4 medium

EPSS

<1%p21

Published

Jun 21, 2024 (Jun 21, 2024)

Modified

Jun 17, 2026

Description

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

Weakness: CWE-693
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.