CVE-2024-47047 json
powermail TYPO3 extension has Insecure Direct Object Reference
published 2024-09-17 2 y ago modified 2026-06-17 4 mo ago also GHSA-q25c-r482-77p9 , EUVD-2024-2850
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
Patch / fix
- packagist in2code/powermail 7.5.1, 8.5.1, 10.9.1, 12.4.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | in2code/powermail | <7.5.1 >=8.0.0, <8.5.1 >=9.0.0, <10.9.1 >=12.0.0, <12.4.1 |
7.5.1 8.5.1 10.9.1 12.4.1 |
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575
web
-
github.com
/in2code-de/powermail/commit/682194d71a5f67fa39d899a9625ba69bb62f9bd8
web
-
github.com
/in2code-de/powermail/commit/91015da289111b86b8dbcb2553d5a722b944231e
web
-
github.com
/in2code-de/powermail/commit/bbadb8d7a71ddb469d07d106551938c91465b811
web
-
typo3.org
/security/advisory/typo3-ext-sa-2024-007
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-47047
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-47047.yaml
web
-
github.com
/in2code-de/powermail
package
Sources
- CVE List CVE-2024-47047
- GitHub Advisory GHSA-q25c-r482-77p9
- NVD CVE-2024-47047
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.