Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1xMjVjLXI0ODItNzdwOc4AA_mj

powermail TYPO3 extension has Insecure Direct Object Reference

An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.

Permalink: https://github.com/advisories/GHSA-q25c-r482-77p9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMjVjLXI0ODItNzdwOc4AA_mj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: 24 days ago


CVSS Score: 4.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C

Identifiers: GHSA-q25c-r482-77p9, CVE-2024-47047
References: Repository: https://github.com/in2code-de/powermail
Blast Radius: 7.4

Affected Packages

packagist:in2code/powermail
Dependent packages: 28
Dependent repositories: 33
Downloads: 1,836,362 total
Affected Version Ranges: >= 12.0.0, < 12.4.1, >= 9.0.0, < 10.9.1, >= 8.0.0, < 8.5.1, < 7.5.1
Fixed in: 12.4.1, 10.9.1, 8.5.1, 7.5.1
All affected versions: 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.9.0, 3.10.0, 3.10.1, 3.11.0, 3.11.1, 3.11.2, 3.12.0, 3.13.0, 3.14.0, 3.15.0, 3.16.0, 3.17.0, 3.18.0, 3.18.1, 3.18.2, 3.19.0, 3.20.0, 3.21.0, 3.21.1, 3.22.0, 3.22.1, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.2.0, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.4.0, 5.0.0, 5.0.1, 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 5.3.2, 5.4.0, 5.5.0, 5.6.0, 6.0.0, 6.1.0, 6.2.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.5.0, 8.0.0, 8.0.1, 8.0.2, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.4.1, 8.4.2, 8.5.0, 9.0.0, 9.0.1, 9.0.2, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.8.0, 10.8.1, 10.8.2, 10.9.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.4.0
All unaffected versions: 7.5.1, 8.5.1, 10.9.1, 10.9.2, 11.0.0, 11.0.1, 11.1.0, 11.2.0, 12.4.1, 12.4.2, 12.4.3