Critical · published December 14, 2022
🔥 Sensitive subscriber data is just a createAction away in the fp_newsletter extension! Think of this like a restaurant that serves up customer orders without checking for paid receipts — anyone with access can see who’s on the guest list without any verification! An attacker could easily steal subscriber information, exposing personal data that could lead to identity theft or targeted phishing attacks. This vulnerability puts your users at risk and can severely damage your reputation as a trusted service provider.
Think of this like a restaurant that serves up customer orders without checking for paid receipts — anyone with access can see who’s on the guest list without any verification! This vulnerability in the fp_newsletter extension allows unauthorized access to subscriber data through createAction operations, affecting versions before 1.1.1, 1.2.0, and various versions of 2.x and 3.x before 3.2.6.
An attacker could easily steal subscriber information, exposing personal data that could lead to identity theft or targeted phishing attacks. This vulnerability puts your users at risk and can severely damage your reputation as a trusted service provider. Upgrade to TYPO3 version 1.1.1, 1.2.0, 2.1.2, 2.4.1, or 3.2.6 to patch this vulnerability immediately. Ensure that proper authentication checks are in place to safeguard subscriber data. You've got this! By updating your systems, you're taking a confident step toward securing your users' data! 🛡️