GHSA-x769-3cwv-f8hcmedium6.0
Powermail extension for TYPO3 allows Insecure Direct Object Reference
The advisory, in context
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
in2code/powermail Packagist
Ecosystem versions
From 12.0.0 before 12.5.3
Fixed in 12.5.3
22 explicitly affected versions
12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.5.0, 12.5.1, 12.5.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"12.0.0",
"12.0.1",
"12.0.2",
"12.0.3",
"12.1.0",
"12.1.1",
"12.2.0",
"12.2.1",
"12.3.0",
"12.3.1",
"12.3.2",
"12.3.3",
"12.3.4",
"12.3.5",
"12.4.0",
"12.4.1",
"12.4.2",
"12.4.3",
"12.4.4",
"12.5.0",
"12.5.1",
"12.5.2"
]
}in2code/powermail Packagist
Ecosystem versions
From 13.0.0 before 13.0.1
Fixed in 13.0.1
1 explicitly affected versions
13.0.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"13.0.0"
]
}