CVE-2019-16698: direct_mail for Typo3 sensitive data exposure
Summary
CVE-2019-16698: direct_mail for Typo3 sensitive data exposure. Affects directmailteam/direct-mail versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The direct_mail extension is a component of TYPO3, a popular open-source content management system. It provides functionality for managing newsletters and email campaigns. The extension allows users to subscribe to newsletters, and their data is stored in the fe_users table. However, a vulnerability in direct_mail versions up to 5.2.2 allows users with restricted permissions to access and export the data of frontend users subscribed to newsletters.
Vulnerability Detail
The vulnerability in direct_mail arises from a missing access check in the backend module. This allows users with limited permissions to view and export sensitive data from the fe_users table, which contains information about frontend users subscribed to newsletters. An attacker with access to the TYPO3 backend and restricted permissions can exploit this vulnerability to obtain personal data of newsletter subscribers. The impact of this vulnerability can range from privacy breaches to potential misuse of personal information.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require directmailteam/direct-mail:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, TYPO3 administrators can restrict access to the direct_mail backend module for users with limited permissions. By adjusting the access controls, administrators can prevent unauthorized users from accessing and exporting sensitive data. However, this is not a permanent solution, and it is strongly advised to update to the latest version of direct_mail as soon as possible.
Conclusion
The direct_mail extension for TYPO3 is vulnerable to sensitive data exposure, allowing users with restricted permissions to access and export personal information of newsletter subscribers. It is crucial to update to the latest version of direct_mail (5.2.3 or later) to mitigate the risk. Restricting access to the backend module can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for directmailteam/direct-mail →
FAQ
direct_mail is an extension for TYPO3 that provides functionality for managing newsletters and email campaigns.
The vulnerability allows users with restricted permissions to access and export sensitive data of frontend users subscribed to newsletters, potentially leading to privacy breaches and misuse of personal information.
To fix this vulnerability, update the direct_mail extension to version 5.2.3 or later.
As a temporary workaround, restrict access to the direct_mail backend module for users with limited permissions.
For more information, refer to the official TYPO3 security advisory or contact the TYPO3 security team.
Related vulnerabilities
Recent vulnerabilities recorded for directmailteam/direct-mail.
