PT-2022-28058 · Typo3 · Fp Newsletter

Martin Waleczek · Published 2022-12-14 · Updated 2025-04-21 · CVE-2022-47408

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions fp newsletter extension versions 1.0 through 1.1.0 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.0 through 2.1.1 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.0 through 3.2.5

Description The issue concerns a CAPTCHA bypass in the fp newsletter extension for TYPO3, which can lead to subscribing many people. This bypass may result in the automated creation of various newsletter subscribers. Additionally, it is possible to provide arbitrary subscription UIDs to the deleteAction of the extension, resulting in all newsletter subscribers being unsubscribed. Insufficient access checks in the createAction and unsubscribeAction can be used to obtain data of existing newsletter subscribers.

Recommendations For fp newsletter extension versions 1.0 through 1.1.0, update to version 1.1.1 or later. For fp newsletter extension version 1.2.0, update to version 2.1.2 or later. For fp newsletter extension versions 2.0 through 2.1.1, update to version 2.1.2 or later. For fp newsletter extension versions 2.2.1 through 2.4.0, update to version 3.2.6 or later. For fp newsletter extension versions 3.0 through 3.2.5, update to version 3.2.6 or later. As a temporary workaround, consider restricting access to the createAction and unsubscribeAction functions until a patch is available. Avoid using the deleteAction with arbitrary subscription UIDs until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2022-47408

GHSA-F683-35W9-28G5

Affected Products

Fp Newsletter

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/fixpunkt/fp-newsletter/CVE-2022-47408.yaml · Exploit
• https://typo3.org/security/advisory/typo3-ext-sa-2022-017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47408 · Security Note
• https://osv.dev/vulnerability/GHSA-f683-35w9-28g5 · Vendor Advisory
• https://github.com/bihor/fp_newsletter · Note
• https://github.com/bihor/fp_newsletter/commit/bc673cd9ab04f3fdd1225303f2ccb378b11a3747 · Note
• https://t.me/cvenotify/39905 · Telegram Post
• https://t.me/cvenotify/119231 · Telegram Post
• https://t.me/cibsecurity/54566 · Telegram Post