GitHub Advisoryadvisory · Packagist

GHSA-f683-35w9-28g5 Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)

CRITICAL Published 2022-12-14 Modified 2023-02-08 Official page ↗
Aliases
CVE-2022-47408
Ecosystem
Packagist
Packages
fixpunkt/fp-newsletter
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-863
Reviewed
2023-02-08

Affected packages

• Packagist fixpunkt/fp-newsletter: >= 2.2.0, < 3.2.6 → fixed in 3.2.6 • Packagist fixpunkt/fp-newsletter: >= 2.0.0, < 2.1.2 → fixed in 2.1.2 • Packagist fixpunkt/fp-newsletter: < 1.1.1 → fixed in 1.1.1

Description

The CAPTCHA of the extension can be bypassed which may result in automated creation of various newsletter subscribers. It is possible to provide arbitrary subscription UIDs to the `deleteAction` of the extension resulting in all newsletter subscribers to be unsubscribed. Insufficient access checks in the `createAction` and `unsubscribeAction` can be used to obtain data of existing newsletter subscribers.

Related

Alias · CVE (1)

  • CVE-2022-47408 An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-863 Incorrect Authorization weakness

References