Design/Logic Flaw

2019-10-1619:15:00

PRIOn knowledge base

www.prio-n.com

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

CPENameOperatorVersion
direct_maille5.2.2

CPE	Name	Operator	Version
	direct_mail	le	5.2.2

References

extensions.typo3.org/extension/direct_mail

typo3.org/security/advisory/typo3-ext-sa-2019-016/