CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
17.7%
in2code/powermail is vulnerable to Insecure Direct Object Reference (IDOR). The vulnerability is due to insufficient validation of the mail parameter in the confirmationAction
of the Powermail extension, allowing an unauthenticated attacker to display user-submitted data of all forms persisted by the extension when it is configured to save data to the database.
github.com/advisories/GHSA-p652-xcgx-f85m
github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-45232.yaml
github.com/in2code-de/powermail/commit/061756732357206f2f13bf39a0676dd266ec9586
github.com/in2code-de/powermail/commit/ac402d4972c77dd119c8db6ffe594c15e8ae0bc5
github.com/in2code-de/powermail/commit/e2ddfaa06d29019d60be02b5a3da04b237ed760b
github.com/in2code-de/powermail/commit/f58d70311799ae5f6acbec52ea9206d21eba91bb
typo3.org/security/advisory/typo3-ext-sa-2024-006