direct_mail for Typo3 sensitive data exposure

Impact

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Original source description

References

• Security advisory nvd.nist.gov/vuln/detail/CVE-2019-16698
• Patch github.com/kartolo/direct_mail/commit/3a70924777294c7fb40e9f6eb3f7627bac58dfd1
• Source reference extensions.typo3.org/extension/direct_mail
• Source reference github.com/kartolo/direct_mail
• Security advisory typo3.org/security/advisory/typo3-ext-sa-2019-016