CVE-2022-47411: fp_newsletter Extension Data Leak Vulnerability
Summary
CVE-2022-47411: "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data. Affects fixpunkt/fp-newsletter across 3 version ranges.
< 1.1.1
>= 1.2.0, < 2.1.2
>= 3.0.0, < 3.2.6
Fixed in 1.1.1, 2.1.2 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The fp_newsletter extension for TYPO3 is designed to manage newsletter subscriptions, allowing users to subscribe and unsubscribe from newsletters. It provides functionalities for handling subscriber data efficiently. However, prior versions of this extension are susceptible to a vulnerability that can lead to unauthorized access to subscriber information.
Vulnerability Detail
An issue was discovered in the fp_newsletter extension before versions 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6. The vulnerability arises from improper handling of unsubscribeAction operations, which allows attackers to obtain sensitive data about subscribers. This could lead to privacy breaches and unauthorized data exposure, significantly impacting user trust and compliance with data protection regulations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.11.1.1composer require fixpunkt/fp-newsletter:1.1.1 -
>= 1.2.0, < 2.1.22.1.2composer require fixpunkt/fp-newsletter:2.1.2 -
>= 3.0.0, < 3.2.63.2.6composer require fixpunkt/fp-newsletter:3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to update the extension immediately, consider disabling the unsubscribe functionality temporarily to prevent unauthorized access to subscriber data until the update can be applied.
Conclusion
The fp_newsletter extension for TYPO3 has a significant vulnerability that can lead to unauthorized access to subscriber data. It is crucial to update to the latest patched versions to protect user information and maintain compliance with data protection standards. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for fixpunkt/fp-newsletter →
FAQ
CVE-2022-47411 is a vulnerability in the fp_newsletter extension for TYPO3 that allows unauthorized access to subscriber data through improper handling of unsubscribe actions.
Affected versions include all versions before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If an immediate update is not possible, disable the unsubscribe functionality to mitigate the risk of data exposure until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for fixpunkt/fp-newsletter.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
