PT-2017-5749 · Typo3 · Typo3 Direct Mail Extension

Bernhard Kraft · Published 2017-12-29 · Updated 2022-05-13 · CVE-2013-7400

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: TYPO3 Direct Mail extension versions prior to 3.1.2

Description: The issue allows remote attackers to obtain sensitive information due to improper checking of authentication codes.

Recommendations: For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-7400

GHSA-4MH5-JJ5W-3F9Q

Affected Products

Typo3 Direct Mail Extension

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-7400 · Security Note
• https://osv.dev/vulnerability/GHSA-4mh5-jj5w-3f9q · Vendor Advisory
• https://extensions.typo3.org/extension/direct_mail · Vendor Advisory
• https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-014 · Vendor Advisory
• https://github.com/kartolo/direct_mail · Note
• http://openwall.com/lists/oss-security/2014/09/11/4 · Note
• https://typo3.org/security/advisory/typo3-ext-sa-2013-014 · Note