GitHub Advisoryadvisory · Packagist

GHSA-j2w4-45qm-r674 direct_mail for Typo3 sensitive data exposure

MEDIUM Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-16698
Ecosystem
Packagist
Packages
directmailteam/direct-mail
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-07-18

Affected packages

• Packagist directmailteam/direct-mail: < 5.2.3 → fixed in 5.2.3

Description

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

Related

Alias · CVE (1)

  • CVE-2019-16698 The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References