Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The “Configuration” backend module of the extension allows an authenticated user to write arbitrary page TSConfig for folders configured as “Direct Mail”. Exploiting the vulnerability may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account having access to the Direct Mail "Configuration" backend module is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.2, 7.0.3 or 6.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The directmail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the feusers table) to view and export data of frontend users who are subscribed to a newsletter.
Recommended action: Upgrade to 5.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Direct Mail (directmail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
Recommended action: Upgrade to 3.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (directmail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 2.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
Recommended action: Upgrade to 5.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The directmail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
Recommended action: Upgrade to 5.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The directmail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
Recommended action: Upgrade to 5.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The directmail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
Recommended action: Upgrade to 5.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.