CVE-2012-5889: Cross-site Scripting Vulnerability in powermail Extension for TYPO3
Summary
CVE-2012-5889: powermail extension for TYPO3 has Cross-site Scripting vulnerability. Affects in2code/powermail versions < 1.6.5. Fixed in 1.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The powermail extension for TYPO3 is a widely used tool that facilitates the creation and management of forms within TYPO3 websites. It allows users to easily create forms, manage submissions, and integrate with various services. However, prior to version 1.6.5, the extension was susceptible to a Cross-site Scripting (XSS) vulnerability, which could be exploited by attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in the powermail extension before version 1.6.5 allows remote attackers to inject arbitrary web scripts or HTML into web pages. This vulnerability arises from insufficient input validation, enabling attackers to manipulate the content displayed to users. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware.
How To Fix
Minimum fixed version
1.6.5
This is the first release that contains the fix.
composer require in2code/powermail:1.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict user input in forms to prevent the execution of scripts. However, this is not a substitute for updating the package. Ensure that any user-generated content is properly sanitized before being rendered on the page.
Conclusion
The powermail extension for TYPO3 has a critical XSS vulnerability that can be exploited by attackers. It is crucial to update to version 1.6.5 or later to ensure the security of your application. Additionally, using tools like Vulert can help you monitor for vulnerabilities in your dependencies effectively.
See every vulnerability recorded for in2code/powermail →
FAQ
The powermail extension is a TYPO3 plugin that allows users to create and manage forms easily on their TYPO3 websites.
The XSS vulnerability allows attackers to inject malicious scripts into web pages, potentially compromising user data and security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to fix this vulnerability could lead to unauthorized access, data theft, and damage to your website's reputation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
