GitHub Advisoryadvisory · Packagist

GHSA-9jqr-5x45-pgw8 Powermail TYPO3 extension Broken Access Control in the OutputController

MEDIUM Published 2024-08-29 Modified 2024-08-30 Official page ↗
Aliases
CVE-2024-45233
Ecosystem
Packagist
Packages
in2code/powermail
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C
Weaknesses
CWE-284, CWE-285
Reviewed
2024-08-29

Affected packages

• Packagist in2code/powermail: < 7.5.0 → fixed in 7.5.0 • Packagist in2code/powermail: >= 8.0.0, < 8.5.0 → fixed in 8.5.0 • Packagist in2code/powermail: >= 9.0.0, < 10.9.0 → fixed in 10.9.0 • Packagist in2code/powermail: >= 11.0.0, < 12.4.0 → fixed in 12.4.0

Description

An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.

Related

Alias · CVE (1)

  • CVE-2024-45233 An issue was discovered in powermail extension through 12.3.5 for TYPO3. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-285 Improper Authorization weakness

References