CVE-2024-47047

Name of the Vulnerable Software and Affected Versions powermail extension versions prior to 7.5.1 powermail extension versions prior to 8.5.1 powermail extension versions prior to 10.9.1 powermail extension versions prior to 12.4.1

Description An issue was discovered in the powermail extension for TYPO3, where it fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension.

Recommendations For versions prior to 7.5.1, update to version 7.5.1 or later. For versions prior to 8.5.1, update to version 8.5.1 or later. For versions prior to 10.9.1, update to version 10.9.1 or later. For versions prior to 12.4.1, update to version 12.4.1 or later.