CVE-2024-45233 json
Powermail TYPO3 extension Broken Access Control in the OutputController
published 2024-08-28 2 y ago modified 2026-06-17 4 mo ago also GHSA-9jqr-5x45-pgw8 , EUVD-2024-2548
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.
Patch / fix
- packagist in2code/powermail 7.5.0, 8.5.0, 10.9.0, 12.4.0
- typo3 typo3 7.5.0, 8.5.0, 10.9.0, 12.4.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | in2code/powermail | <7.5.0 >=8.0.0, <8.5.0 >=9.0.0, <10.9.0 >=11.0.0, <12.4.0 |
7.5.0 8.5.0 10.9.0 12.4.0 |
Affected products
- typo3 typo3
Classification
References
-
github.com
/in2code-de/powermail/commit/04a010c4009202e8e1b4c72accd4d7b2771b80b3
web
-
github.com
/in2code-de/powermail/commit/2c8a1bf7669eb0661e8a93164f57e4b653ac3408
web
-
github.com
/in2code-de/powermail/commit/6e94ec5e0c7b553c467b826df1b922db6c2ad08e
web
-
github.com
/in2code-de/powermail/commit/f56f8eefe151ad67cbd32c21f1106953b8e4f19f
web
-
typo3.org
/security/advisory/typo3-ext-sa-2024-006
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-45233
advisory
-
github.com
/in2code-de/powermail
package
Sources
- CVE List CVE-2024-45233
- GitHub Advisory GHSA-9jqr-5x45-pgw8
- NVD CVE-2024-45233
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.