PT-2022-28062 · Typo3 · Fp Newsletter

Oliver Hader · CVE-2022-47411 · Published 2022-12-14 · Updated 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions fp newsletter extension versions 1.0 through 1.1.0 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.0 through 2.1.1 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.0 through 3.2.5

Description An issue was discovered in the fp newsletter extension for TYPO3, where data about subscribers may be obtained via unsubscribeAction operations.

Recommendations For fp newsletter extension versions 1.0 through 1.1.0, update to version 1.1.1 or later. For fp newsletter extension version 1.2.0, update to version 2.1.2 or later. For fp newsletter extension versions 2.0 through 2.1.1, update to version 2.1.2 or later. For fp newsletter extension versions 2.2.1 through 2.4.0, update to version 3.2.6 or later. For fp newsletter extension versions 3.0 through 3.2.5, update to version 3.2.6 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Information Disclosure

Weakness Enumeration

CWE-668

CWE-200

Related Identifiers

CVE-2022-47411

GHSA-R44W-PFX8-28JV

Affected Products

Fp Newsletter

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/47xxx/CVE-2022-47411.json · Exploit
• https://typo3.org/security/advisory/typo3-ext-sa-2022-017 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r44w-pfx8-28jv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47411 · Security Note
• https://github.com/bihor/fp_newsletter · Note
• https://t.me/cvenotify/40094 · Telegram Post
• https://t.me/cibsecurity/54565 · Telegram Post