CVE-2013-7400: Direct Mail TYPO3 Extension Sensitive Information Disclosure
Summary
CVE-2013-7400: The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information. Affects directmailteam/direct-mail versions < 3.1.2. Fixed in 3.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Direct Mail extension for TYPO3 is designed to facilitate email marketing campaigns within TYPO3-based websites. It enables users to manage mailing lists, create newsletters, and send targeted emails. However, prior to version 3.1.2, the extension had a significant vulnerability that allowed unauthorized access to sensitive information due to improper authentication checks.
Vulnerability Detail
The vulnerability arises from the Direct Mail extension's failure to adequately verify authentication codes, allowing remote attackers to exploit this weakness. This could lead to unauthorized access to sensitive user data, which poses a high risk to the integrity and confidentiality of the information managed by the extension. The potential ramifications include data breaches and loss of user trust, making it critical to address this issue promptly.
How To Fix
Minimum fixed version
3.1.2
This is the first release that contains the fix.
composer require directmailteam/direct-mail:3.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Direct Mail extension by implementing additional authentication checks or limiting access to trusted IP addresses. However, this is not a permanent solution and updating the extension is highly recommended.
Conclusion
The Direct Mail TYPO3 extension has a critical vulnerability that can lead to unauthorized access to sensitive information. It is essential to update to version 3.1.2 or later to mitigate this risk. Implementing additional security measures can provide temporary relief, but updating the extension is the best course of action.
See every vulnerability recorded for directmailteam/direct-mail →
FAQ
CVE-2013-7400 is a vulnerability identifier for a security issue in the Direct Mail TYPO3 extension that allows unauthorized access to sensitive information.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The consequences include potential data breaches and unauthorized access to sensitive user information, which can damage your organization's reputation and user trust.
Yes, the vulnerability is fixed in version 3.1.2 of the Direct Mail extension. Updating to this version or later will resolve the issue.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for directmailteam/direct-mail.
