CVE-2009-4159: TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)
Summary
CVE-2009-4159: TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS). Affects directmailteam/direct-mail versions < 2.6.5. Fixed in 2.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Direct Mail extension for TYPO3 is a powerful tool designed for managing newsletter campaigns within the TYPO3 content management system. It allows users to create, send, and manage newsletters effectively. However, versions 2.6.4 and earlier are susceptible to a Cross-Site Scripting (XSS) vulnerability, which can be exploited by remote authenticated users to inject malicious scripts or HTML into the application.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the newsletter configuration feature of the Direct Mail extension. This flaw allows attackers to inject arbitrary web scripts or HTML, potentially leading to unauthorized actions being performed on behalf of the user, data theft, or spreading malware. The issue is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
2.6.5
This is the first release that contains the fix.
composer require directmailteam/direct-mail:2.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the backend module of the Direct Mail extension to trusted users only. This can help mitigate the risk of exploitation until the extension is updated.
Conclusion
The TYPO3 Direct Mail extension versions 2.6.4 and earlier are vulnerable to a Cross-Site Scripting (XSS) attack, which can have serious implications for user security. It is crucial to update to version 2.6.5 or later to mitigate this risk. Users should also consider implementing access restrictions as a temporary workaround.
See every vulnerability recorded for directmailteam/direct-mail →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, or the distribution of malware, compromising the security of the affected application.
Yes, you can restrict access to the backend module of the Direct Mail extension to trusted users only as a temporary measure.
More information about the Direct Mail extension can be found on the TYPO3 official website and its documentation.
Related vulnerabilities
Recent vulnerabilities recorded for directmailteam/direct-mail.
