CVE-2020-12699

The CVE-2020-12699 entry concerns the TYPO3 Direct Mail (direct_mail) extension up to version 5.2.3, where the jumpUrl parameter is not sanitized, enabling an Open Redirect. This conclusion is supported by multiple connected sources (Veracode, GHSA/OSV, CVE records) describing an Open Redirect vi...

CVE-2020-12698

The Direct Mail extension for TYPO3 (direct_mail) up to version 5.2.3 has Broken Access Control affecting newsletter subscriber tables when exporting via CSV. The vulnerability arises from insufficient authorization checks for backend users accessing data (e.g., tt_address, fe_users) during CSV e...

CVE-2020-12697

The directmail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries...

CVE-2020-12697

The CVE-2020-12697 entry affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.3. Root cause: a logging mechanism for link clicks has no cap on log entry generation, enabling an attacker to cause excessive log writes and trigger a denial of service. Impact is described as DoS vi...

CVE-2019-16698

The CVE-2019-16698 issue affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.2. A missing access check in the backend module allows a user with restricted permissions (to fe_users) to view and export data of frontend newsletter subscribers. The condition is an information-disc...