Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-47047

Good to know:

icon

Date: September 16, 2024

An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.

Severity Score

Related Resources (9)

https://github.com/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575
https://typo3.org/security/advisory/typo3-ext-sa-2024-007
https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-47047.yaml
https://github.com/in2code-de/powermail/commit/bbadb8d7a71ddb469d07d106551938c91465b811
https://nvd.nist.gov/vuln/detail/CVE-2024-47047
https://github.com/in2code-de/powermail
https://github.com/in2code-de/powermail/commit/91015da289111b86b8dbcb2553d5a722b944231e
https://github.com/in2code-de/powermail/commit/682194d71a5f67fa39d899a9625ba69bb62f9bd8
https://www.mend.io/vulnerability-database/CVE-2024-47047

Severity Score

Weakness Type (CWE)

Authorization Bypass Through User-Controlled Key

CWE-639

Top Fix

icon

Upgrade Version

Upgrade to version 7.5.1,8.5.1,10.9.1,12.4.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us