PT-2022-28062 · Typo3 · Fp Newsletter

Oliver Hader · Published 2022-12-14 · Updated 2023-08-08 · CVE-2022-47411

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions fp newsletter extension versions 1.0 through 1.1.0 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.0 through 2.1.1 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.0 through 3.2.5

Description An issue was discovered in the fp newsletter extension for TYPO3, where data about subscribers may be obtained via unsubscribeAction operations.

Recommendations For fp newsletter extension versions 1.0 through 1.1.0, update to version 1.1.1 or later. For fp newsletter extension version 1.2.0, update to version 2.1.2 or later. For fp newsletter extension versions 2.0 through 2.1.1, update to version 2.1.2 or later. For fp newsletter extension versions 2.2.1 through 2.4.0, update to version 3.2.6 or later. For fp newsletter extension versions 3.0 through 3.2.5, update to version 3.2.6 or later.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2022-47411

GHSA-R44W-PFX8-28JV

Affected Products

Fp Newsletter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-47411 · Security Note
• https://osv.dev/vulnerability/GHSA-r44w-pfx8-28jv · Vendor Advisory
• https://typo3.org/security/advisory/typo3-ext-sa-2022-017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47411 · Vendor Advisory
• https://github.com/bihor/fp_newsletter · Note
• https://t.me/cibsecurity/54565 · Telegram Post
• https://t.me/cvenotify/40094 · Telegram Post