CVE-2024-38874

5.4 mediumEPSS 0.3%

Medium (5.4). EPSS 0.3% chance of exploitation in the next 30 days.

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-693
Published: 2024-06-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://typo3.org/security/advisory/typo3-ext-sa-2024-003
https://typo3.org/security/advisory/typo3-ext-sa-2024-003

Check your stack JSON