Powermail TYPO3 extension Broken Access Control in the OutputController
Summary
CVE-2024-45233: Powermail TYPO3 extension Broken Access Control in the OutputController. Affects in2code/powermail across 4 version ranges.
< 7.5.0
>= 8.0.0, < 8.5.0
>= 9.0.0, < 10.9.0
>= 11.0.0, < 12.4.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Powermail is a TYPO3 extension that allows users to create and manage forms on their TYPO3 websites. It provides a user-friendly interface for creating and customizing forms, as well as features for managing form submissions. The extension is widely used and has a large user base. However, a vulnerability has been discovered in the OutputController of Powermail, which can lead to Broken Access Control.
Vulnerability Detail
The vulnerability in the OutputController of Powermail allows several actions to be directly called without proper access checks. This can be exploited by an unauthenticated attacker to edit, update, delete, or export data of persisted forms, depending on the configuration of the Powermail Frontend plugins. This vulnerability can only be exploited when the Powermail Frontend plugins are used. The impact of this vulnerability can be significant, as it allows unauthorized access and manipulation of form data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.5.07.5.0composer require in2code/powermail:7.5.0 -
>= 8.0.0, < 8.5.08.5.0composer require in2code/powermail:8.5.0 -
>= 9.0.0, < 10.9.010.9.0composer require in2code/powermail:10.9.0 -
>= 11.0.0, < 12.4.012.4.0composer require in2code/powermail:12.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions of Powermail to mitigate the risk.
Conclusion
The vulnerability in the OutputController of Powermail can lead to Broken Access Control, allowing unauthorized access and manipulation of form data. It is crucial to update to the fixed versions of Powermail (7.5.0, 8.5.0, 10.9.0, or 12.4.0) to mitigate the risk.
See every vulnerability recorded for in2code/powermail →
FAQ
Powermail is a TYPO3 extension that allows users to create and manage forms on their TYPO3 websites.
The vulnerability allows unauthorized access and manipulation of form data, potentially leading to data breaches or unauthorized modifications.
To fix this vulnerability, update to the latest versions of Powermail (7.5.0, 8.5.0, 10.9.0, or 12.4.0).
No, there is no known workaround. Updating to the fixed versions is the recommended solution.
No, this vulnerability can only be exploited when the Powermail Frontend plugins are used.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
