FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass

published 2024-06-21 2 y ago modified 2026-06-17 4 mo ago also GHSA-jg62-h7pv-hxgv , EUVD-2024-2090

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits: 0; none known

An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check the requirement of the captcha field in submitted form data, allowing a remote user to bypass the captcha check. This only affects the captcha integration for the ext:form extension.

Patch / fix

fixed in 1

packagist studiomitte/friendlycaptcha 0.1.4

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-06-25)

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
packagist	studiomitte/friendlycaptcha	<0.1.4	0.1.4

Affected products

typo3 friendlycaptcha_official

Classification

Weakness

CWE-284 Improper Access Control

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary