CVE-2019-16698

Name of the Vulnerable Software and Affected Versions TYPO3 direct mail extension versions through 5.2.2

Description The issue is related to a missing access check in the backend module of the direct mail extension, which allows a user with restricted permissions to the fe users table to view and export data of frontend users subscribed to a newsletter.

Recommendations For versions through 5.2.2, consider restricting access to the backend module of the direct mail extension to prevent unauthorized viewing and export of frontend user data until a fix is available.