CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

PT-2023-31565

Name of the Vulnerable Software and Affected Versions TYPO3 versions 9.5 and below TYPO3 versions 10.4 and above Description The issue allows an authenticated user to write arbitrary page TSConfig for folders configured as "Direct Mail". This can lead to Configuration Injection in TYPO3 10.4 and...