PT-2009-6327 · Typo3 · Typo3 Direct Mail

Georg Ringer · Published 2009-12-02 · Updated 2022-05-02 · CVE-2009-4159

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 Direct Mail (direct mail) extension versions 2.6.4 and earlier

Description A cross-site scripting (XSS) issue exists in the newsletter configuration feature of the backend module. This allows remote authenticated users to inject arbitrary web script or HTML.

Recommendations For versions 2.6.4 and earlier, update to a version later than 2.6.4 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4159

GHSA-7X6F-JVMG-6FGP

Affected Products

Typo3 Direct Mail

References · 9

• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-018 · Vendor Advisory
• http://typo3.org/extensions/repository/view/direct_mail/2.6.5 · Patch
• https://osv.dev/vulnerability/GHSA-7x6f-jvmg-6fgp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4159 · Security Note
• http://secunia.com/advisories/37552 · Vendor Advisory
• https://github.com/kartolo/direct_mail · Note
• http://securityfocus.com/bid/37166 · Note
• https://web.archive.org/web/20200228220911/http://securityfocus.com/bid/37166 · Note
• https://web.archive.org/web/20110108051351/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-018 · Note