CVE-2020-12699

The CVE-2020-12699 entry concerns the TYPO3 Direct Mail (direct_mail) extension up to version 5.2.3, where the jumpUrl parameter is not sanitized, enabling an Open Redirect. This conclusion is supported by multiple connected sources (Veracode, GHSA/OSV, CVE records) describing an Open Redirect vi...

CVE-2020-12698

The Direct Mail extension for TYPO3 (direct_mail) up to version 5.2.3 has Broken Access Control affecting newsletter subscriber tables when exporting via CSV. The vulnerability arises from insufficient authorization checks for backend users accessing data (e.g., tt_address, fe_users) during CSV e...

CVE-2020-12700

The CVE-2020-12700 issue affects TYPO3's Direct Mail extension (direct_mail), version up to 5.2.3. The root cause is a missing access check for an authenticated backend user when using the Special Query feature, which enables Information Disclosure of newsletter subscriber data. Documented impact...

CVE-2020-12697

The CVE-2020-12697 entry affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.3. Root cause: a logging mechanism for link clicks has no cap on log entry generation, enabling an attacker to cause excessive log writes and trigger a denial of service. Impact is described as DoS vi...