GitHub Advisoryadvisory · Packagist

GHSA-vxmc-qg5x-pvfx "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data

HIGH Published 2022-12-14 Modified 2025-04-21 Official page ↗
Aliases
CVE-2022-47410
Ecosystem
Packagist
Packages
fixpunkt/fp-newsletter
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-668
Reviewed
2025-04-21

Affected packages

• Packagist fixpunkt/fp-newsletter: < 1.1.1 → fixed in 1.1.1 • Packagist fixpunkt/fp-newsletter: >= 1.2.0, < 2.1.2 → fixed in 2.1.2 • Packagist fixpunkt/fp-newsletter: >= 3.0.0, < 3.2.6 → fixed in 3.2.6

Description

An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.

Related

Alias · CVE (1)

  • CVE-2022-47410 An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References