CVE-2024-45232 json
"powermail" (powermail) Insecure Direct Object Reference (IDOR)
published 2024-08-28 2 y ago modified 2026-06-17 4 mo ago also GHSA-p652-xcgx-f85m , EUVD-2024-2621
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference (IDOR). An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the extension. This can only be exploited when the extension is configured to save submitted form data to the database (plugin.tx_powermail.settings.db.enable=1), which however is the default setting of the extension. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0
Patch / fix
- packagist in2code/powermail 7.5.0, 8.5.0, 10.9.0, 12.4.0
- typo3 typo3 7.5.0, 8.5.0, 10.9.0, 12.4.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | in2code/powermail | >=11.0.0, <12.4.0 >=9.0.0, <10.9.0 >=8.0.0, <8.5.0 <7.5.0 |
12.4.0 10.9.0 8.5.0 7.5.0 |
Affected products
- typo3 typo3
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/in2code-de/powermail/commit/061756732357206f2f13bf39a0676dd266ec9586
web
-
github.com
/in2code-de/powermail/commit/ac402d4972c77dd119c8db6ffe594c15e8ae0bc5
web
-
github.com
/in2code-de/powermail/commit/e2ddfaa06d29019d60be02b5a3da04b237ed760b
web
-
github.com
/in2code-de/powermail/commit/f58d70311799ae5f6acbec52ea9206d21eba91bb
web
-
typo3.org
/security/advisory/typo3-ext-sa-2024-006
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-45232
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-45232.yaml
web
-
github.com
/in2code-de/powermail
package
Sources
- CVE List CVE-2024-45232
- GitHub Advisory GHSA-p652-xcgx-f85m
- NVD CVE-2024-45232
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.