PT-2022-28061 · Typo3 · Fp Newsletter

Oliver Hader · Published 2022-12-14 · Updated 2023-08-08 · CVE-2022-47410

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions fp newsletter extension versions prior to 1.1.1 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.x prior to 2.1.2 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.x prior to 3.2.6

Description An issue was discovered in the fp newsletter extension for TYPO3, where data about subscribers may be obtained via createAction operations.

Recommendations For fp newsletter extension versions prior to 1.1.1, update to version 1.1.1 or later. For fp newsletter extension version 1.2.0, update to version 2.1.2 or later. For fp newsletter extension versions 2.x prior to 2.1.2, update to version 2.1.2 or later. For fp newsletter extension versions 2.2.1 through 2.4.0, update to version 3.2.6 or later. For fp newsletter extension versions 3.x prior to 3.2.6, update to version 3.2.6 or later. As a temporary workaround, consider restricting access to the createAction operations until a patch is available.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2022-47410

GHSA-VXMC-QG5X-PVFX

Affected Products

Fp Newsletter

References · 8

• https://osv.dev/vulnerability/CVE-2022-47410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47410 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2022-017 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxmc-qg5x-pvfx · Vendor Advisory
• https://github.com/bihor/fp_newsletter · Note
• https://t.me/cibsecurity/54575 · Telegram Post
• https://t.me/cvenotify/39903 · Telegram Post
• https://t.me/cvenotify/40095 · Telegram Post