p PatchFirst

CVE-2019-16698

CVE-2019-16698

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

CVSS 4.3 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • directmailteam/direct-mail Packagist

    Versions
    • 5.0
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • v5.1.1
    Affected ranges
    • ECOSYSTEM: < 5.2.3

    Update to 5.2.3

Original sources

Check your server →