CVE-2024-45232: Insecure Direct Object Reference (IDOR) in powermail
Summary
CVE-2024-45232: "powermail" (powermail) Insecure Direct Object Reference (IDOR). Affects in2code/powermail across 4 version ranges.
< 7.5.0
>= 8.0.0, < 8.5.0
>= 9.0.0, < 10.9.0
>= 11.0.0, < 12.4.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
powermail is an extension for TYPO3 that allows users to create and manage forms. It provides a range of features for form creation, submission, and data storage. The extension is widely used and enables website administrators to collect user-submitted data through forms.
Vulnerability Detail
The powermail extension through version 12.3.5 for TYPO3 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. The issue arises from the lack of validation of the 'mail' parameter in the confirmationAction. This vulnerability allows an unauthenticated attacker to access and display user-submitted data from all forms stored by the extension. The vulnerability can only be exploited when the extension is configured to save form data to the database, which is the default setting. The impact of this vulnerability can be significant as it exposes sensitive user information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.5.07.5.0composer require in2code/powermail:7.5.0 -
>= 8.0.0, < 8.5.08.5.0composer require in2code/powermail:8.5.0 -
>= 9.0.0, < 10.9.010.9.0composer require in2code/powermail:10.9.0 -
>= 11.0.0, < 12.4.012.4.0composer require in2code/powermail:12.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update the powermail extension to the fixed versions mentioned above.
Conclusion
The powermail extension for TYPO3 is affected by an Insecure Direct Object Reference (IDOR) vulnerability that allows unauthorized access to user-submitted data. It is crucial to update the extension to the fixed versions to mitigate this vulnerability and protect user information.
See every vulnerability recorded for in2code/powermail →
FAQ
powermail is a popular TYPO3 extension used for creating and managing forms on websites. It allows website administrators to collect user-submitted data through forms.
An Insecure Direct Object Reference (IDOR) vulnerability occurs when an application fails to properly validate user access to resources. In this case, the powermail extension allows unauthorized access to user-submitted data.
An unauthenticated attacker can exploit this vulnerability by accessing the 'mail' parameter in the confirmationAction of the powermail extension. This allows them to view user-submitted data from all forms stored by the extension.
The impact of this vulnerability is significant as it exposes sensitive user information. An attacker can access and view user-submitted data from all forms stored by the powermail extension.
The recommended mitigation is to update the powermail extension to one of the fixed versions: 7.5.0, 8.5.0, 10.9.0, or 12.4.0. This will prevent unauthorized access to user-submitted data.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
