GitHub Advisory DatabaseGHSA-F683-35W9-28G5Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
50.6%
The CAPTCHA of the extension can be bypassed which may result in automated creation of various newsletter subscribers. It is possible to provide arbitrary subscription UIDs to the deleteAction of the extension resulting in all newsletter subscribers to be unsubscribed. Insufficient access checks in the createAction and unsubscribeAction can be used to obtain data of existing newsletter subscribers.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| fixpunkt/fp-newsletter | lt | 1.1.1 | |
| fixpunkt/fp-newsletter | lt | 2.1.2 | |
| fixpunkt/fp-newsletter | lt | 3.2.6 |
References
github.com/advisories/GHSA-f683-35w9-28g5
github.com/bihor/fp_newsletter/commit/bc673cd9ab04f3fdd1225303f2ccb378b11a3747
github.com/FriendsOfPHP/security-advisories/blob/master/fixpunkt/fp-newsletter/CVE-2022-47408.yaml
nvd.nist.gov/vuln/detail/CVE-2022-47408
typo3.org/security/advisory/typo3-ext-sa-2022-017
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
50.6%