Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05anFyLTV4NDUtcGd3OM4AA_AM

Powermail TYPO3 extension Broken Access Control in the OutputController

An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.

Permalink: https://github.com/advisories/GHSA-9jqr-5x45-pgw8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05anFyLTV4NDUtcGd3OM4AA_AM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 3 months ago


CVSS Score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C

Identifiers: GHSA-9jqr-5x45-pgw8, CVE-2024-45233
References: Repository: https://github.com/in2code-de/powermail
Blast Radius: 10.3

Affected Packages

packagist:in2code/powermail
Dependent packages: 28
Dependent repositories: 33
Downloads: 1,865,209 total
Affected Version Ranges: >= 11.0.0, < 12.4.0, >= 9.0.0, < 10.9.0, >= 8.0.0, < 8.5.0, < 7.5.0
Fixed in: 12.4.0, 10.9.0, 8.5.0, 7.5.0
All affected versions: 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.9.0, 3.10.0, 3.10.1, 3.11.0, 3.11.1, 3.11.2, 3.12.0, 3.13.0, 3.14.0, 3.15.0, 3.16.0, 3.17.0, 3.18.0, 3.18.1, 3.18.2, 3.19.0, 3.20.0, 3.21.0, 3.21.1, 3.22.0, 3.22.1, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.2.0, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.4.0, 5.0.0, 5.0.1, 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 5.3.2, 5.4.0, 5.5.0, 5.6.0, 6.0.0, 6.1.0, 6.2.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 8.0.0, 8.0.1, 8.0.2, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.4.1, 8.4.2, 9.0.0, 9.0.1, 9.0.2, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.8.0, 10.8.1, 10.8.2, 11.0.0, 11.0.1, 11.1.0, 11.2.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5
All unaffected versions: 7.5.0, 7.5.1, 8.5.0, 8.5.1, 10.9.0, 10.9.1, 10.9.2, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4