CVE-2024-47047

An issue was discovered in the powermail extension through 12.4.0 for TYPO3

High · published September 17, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00485 · 40.8th percentile
Published
2024-09-17T00:00Z
EPSS history
Timeline
  • 17 SEP 00:00Z
    An issue was discovered in the powermail extension through 12.4.0 for TYPO3
    cvelistv5