CVE-2022-47408: Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)
Summary
CVE-2022-47408: Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter). Affects fixpunkt/fp-newsletter across 3 version ranges.
< 1.1.1
>= 2.0.0, < 2.1.2
>= 2.2.0, < 3.2.6
Fixed in 1.1.1, 2.1.2 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The "Newsletter subscriber management" extension (fp_newsletter) is a package available on Packagist. It provides functionality for managing newsletter subscribers. The extension allows users to create, delete, and unsubscribe newsletter subscribers. However, it has been found to have multiple vulnerabilities that can be exploited by attackers.
Vulnerability Detail
The extension has three main vulnerabilities. Firstly, the CAPTCHA of the extension can be bypassed, allowing automated creation of various newsletter subscribers. This can lead to an influx of unwanted subscribers and potential abuse of the newsletter system. Secondly, the deleteAction of the extension allows arbitrary subscription UIDs to be provided, resulting in the unsubscribing of all newsletter subscribers. This can cause disruption to legitimate subscribers and potentially impact the effectiveness of the newsletter. Lastly, the createAction and unsubscribeAction lack sufficient access checks, which can be exploited to obtain data of existing newsletter subscribers. This can lead to a breach of privacy and potential misuse of subscriber information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.11.1.1composer require fixpunkt/fp-newsletter:1.1.1 -
>= 2.0.0, < 2.1.22.1.2composer require fixpunkt/fp-newsletter:2.1.2 -
>= 2.2.0, < 3.2.63.2.6composer require fixpunkt/fp-newsletter:3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. The recommended solution is to update the extension to the latest version.
Conclusion
The "Newsletter subscriber management" extension (fp_newsletter) has been found to have multiple vulnerabilities that can be exploited to create unwanted subscribers, unsubscribe all subscribers, and obtain subscriber data. It is crucial to update the extension to version 3.2.6 or later to mitigate these vulnerabilities. For further support and guidance, you can reach out to DevNack.com.
See every vulnerability recorded for fixpunkt/fp-newsletter →
FAQ
The impact of these vulnerabilities can range from automated creation of unwanted newsletter subscribers to unauthorized access and potential misuse of subscriber data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your composer.lock file and the playground will analyze it for any vulnerable packages.
There are no known exploits for these vulnerabilities at the moment. However, it is important to update the extension to the latest version to mitigate any potential risks.
It is not recommended to manually fix the vulnerabilities without updating the extension. The fixes provided in the latest version are specifically designed to address these vulnerabilities and ensure the security of the system.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing the vulnerabilities in your installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for fixpunkt/fp-newsletter.
