GitHub Advisoryadvisory · Packagist

GHSA-48ww-8h7g-4hwq TYPO3 is vulnerable to Spam Abuse in the native form content element

MEDIUM Published 2022-04-21 Modified 2024-02-06 Official page ↗
Aliases
CVE-2010-3667
Ecosystem
Packagist
Packages
typo3/cms-frontend
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2024-02-06

Affected packages

• Packagist typo3/cms-frontend: < 4.1.14 → fixed in 4.1.14 • Packagist typo3/cms-frontend: >= 4.2.0, < 4.2.13 → fixed in 4.2.13 • Packagist typo3/cms-frontend: >= 4.3.0, < 4.3.4 → fixed in 4.3.4 • Packagist typo3/cms-frontend: >= 4.4.0, < 4.4.1 → fixed in 4.4.1

Description

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element. An attacker could abuse the form to send mails to arbitrary email addresses.

Related

Alias · CVE (1)

  • CVE-2010-3667 TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References