GitHub Advisoryadvisory · Packagist

GHSA-hqm2-gwqf-r5g5 SQL injection in TYPO3 extension

CRITICAL Published 2021-09-02 Modified 2021-08-30 Official page ↗

Aliases: CVE-2021-38302
Ecosystem: Packagist
Packages: ecodev/newsletter
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:F/RL:U/RC:C
Weaknesses: CWE-89
Reviewed: 2021-08-30

Affected packages

• Packagist ecodev/newsletter: <= 4.0.0 (no fix yet)

Description

It has been discovered that the extension is susceptible to SQL Injection when processing bounced emails.

Related

Alias · CVE (1)

CVE-2021-38302 The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection. vulnerability

Weakness · CWE (1)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References