PT-2024-32371 · Typo3 · Powermail

Torben Hansen · Published 2024-09-17 · Updated 2024-09-27 · CVE-2024-47047

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions powermail extension versions prior to 7.5.1 powermail extension versions prior to 8.5.1 powermail extension versions prior to 10.9.1 powermail extension versions prior to 12.4.1

Description An issue was discovered in the powermail extension for TYPO3, where it fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension.

Recommendations For versions prior to 7.5.1, update to version 7.5.1 or later. For versions prior to 8.5.1, update to version 8.5.1 or later. For versions prior to 10.9.1, update to version 10.9.1 or later. For versions prior to 12.4.1, update to version 12.4.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-47047

GHSA-Q25C-R482-77P9

Affected Products

Powermail

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-47047.yaml · Exploit
• https://typo3.org/security/advisory/typo3-ext-sa-2024-007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47047 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q25c-r482-77p9 · Vendor Advisory
• https://github.com/in2code-de/powermail · Note
• https://github.com/in2code-de/powermail/commit/bbadb8d7a71ddb469d07d106551938c91465b811 · Note
• https://github.com/in2code-de/powermail/commit/682194d71a5f67fa39d899a9625ba69bb62f9bd8 · Note
• https://github.com/in2code-de/powermail/commit/91015da289111b86b8dbcb2553d5a722b944231e · Note
• https://github.com/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575 · Note
• https://t.me/cvenotify/96390 · Telegram Post
• https://t.me/cvedetector/5813 · Telegram Post
• https://twitter.com/CVEnew/status/1836037612693553563 · Twitter Post