{"id":"GHSA-q25c-r482-77p9","aliases":["CVE-2024-47047"],"title":"powermail TYPO3 extension has Insecure Direct Object Reference","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.","severity":"medium","score":5.3,"published":"2024-09-17T15:31:23.000Z","modified":"2025-03-19T15:34:06.472Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"in2code/powermail","sources":[{"name":"OSV · GHSA-q25c-r482-77p9","url":"https://osv.dev/vulnerability/GHSA-q25c-r482-77p9"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.5.1"}],"type":"ECOSYSTEM"}],"versions":["3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.18.0","3.18.1","3.18.2","3.19.0","3.2.0","3.20.0","3.21.0","3.21.1","3.22.0","3.22.1","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.3.1","4.3.2","4.3.3","4.3.4","4.3.5","4.4.0","5.0.0","5.0.1","5.1.0","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.4.0","5.5.0","5.6.0","6.0.0","6.1.0","6.2.0","7.0.0","7.1.0","7.2.0","7.3.0","7.3.1","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0"],"fixed":["7.5.1"]},{"ecosystem":"Packagist","name":"in2code/powermail","sources":[{"name":"OSV · GHSA-q25c-r482-77p9","url":"https://osv.dev/vulnerability/GHSA-q25c-r482-77p9"}],"ranges":[{"events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}],"type":"ECOSYSTEM"}],"versions":["8.0.0","8.0.1","8.0.2","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.4.1","8.4.2","8.5.0"],"fixed":["8.5.1"]},{"ecosystem":"Packagist","name":"in2code/powermail","sources":[{"name":"OSV · GHSA-q25c-r482-77p9","url":"https://osv.dev/vulnerability/GHSA-q25c-r482-77p9"}],"ranges":[{"events":[{"introduced":"9.0.0"},{"fixed":"10.9.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.1.0","10.2.0","10.3.0","10.3.1","10.3.2","10.3.3","10.4.0","10.4.1","10.4.2","10.4.3","10.5.0","10.6.0","10.6.1","10.7.0","10.7.1","10.7.2","10.7.3","10.7.4","10.8.0","10.8.1","10.8.2","10.9.0","9.0.0","9.0.1","9.0.2"],"fixed":["10.9.1"]},{"ecosystem":"Packagist","name":"in2code/powermail","sources":[{"name":"OSV · GHSA-q25c-r482-77p9","url":"https://osv.dev/vulnerability/GHSA-q25c-r482-77p9"}],"ranges":[{"events":[{"introduced":"12.0.0"},{"fixed":"12.4.1"}],"type":"ECOSYSTEM"}],"versions":["12.0.0","12.0.1","12.0.2","12.0.3","12.1.0","12.1.1","12.2.0","12.2.1","12.3.0","12.3.1","12.3.2","12.3.3","12.3.4","12.3.5","12.4.0"],"fixed":["12.4.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-47047","https://github.com/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575","https://github.com/in2code-de/powermail/commit/682194d71a5f67fa39d899a9625ba69bb62f9bd8","https://github.com/in2code-de/powermail/commit/91015da289111b86b8dbcb2553d5a722b944231e","https://github.com/in2code-de/powermail/commit/bbadb8d7a71ddb469d07d106551938c91465b811","https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-47047.yaml","https://github.com/in2code-de/powermail","https://typo3.org/security/advisory/typo3-ext-sa-2024-007"],"sources":[{"name":"OSV","id":"GHSA-q25c-r482-77p9","modified":"2025-03-19T15:34:06.472568Z","url":"https://osv.dev/vulnerability/GHSA-q25c-r482-77p9"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C","score":5.3},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":5.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:30:33.731Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}