CVE-2024-45233
Critical
Description
An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.
SeverityCritical
CVSS9.8
Exploit probability—
ProductIn2code Powermail
PublishedAug 29, 2024
First seenAug 29, 2024
Weakness typeCWE-284Improper access control
How to fix
Update
- in2code powermail7.5.0, 8.5.0, 10.9.0, 12.4.0 or later
- in2code/powermail7.5.0, 8.5.0, 10.9.0, 12.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| in2code powermail | v < 7.5.0, 8.0.0 ≤ v < 8.5.0, 9.0.0 ≤ v < 10.9.0, 12.0.0 ≤ v < 12.4.0 | 7.5.0, 8.5.0, 10.9.0, 12.4.0 |
| in2code/powermailPackagist | v < 7.5.0, 8.0.0 ≤ v < 8.5.0, 9.0.0 ≤ v < 10.9.0, 11.0.0 ≤ v < 12.4.0 | 7.5.0, 8.5.0, 10.9.0, 12.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.