GHSA-f683-35w9-28g5
Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | fixpunkt/fp-newsletter | >= 2.2.0, < 3.2.6 | 3.2.6 |
| Packagist | fixpunkt/fp-newsletter | >= 2.0.0, < 2.1.2 | 2.1.2 |
| Packagist | fixpunkt/fp-newsletter | < 1.1.1 | 1.1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
The CAPTCHA of the extension can be bypassed which may result in automated creation of various newsletter subscribers. It is possible to provide arbitrary subscription UIDs to the `deleteAction` of the extension resulting in all newsletter subscribers to be unsubscribed. Insufficient access checks in the `createAction` and `unsubscribeAction` can be used to obtain data of existing newsletter subscribers.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-47408
- https://github.com/bihor/fp_newsletter/commit/bc673cd9ab04f3fdd1225303f2ccb378b11a3747
- https://github.com/FriendsOfPHP/security-advisories/blob/master/fixpunkt/fp-newsletter/CVE-2022-47408.yaml
- https://github.com/bihor/fp_newsletter
- https://typo3.org/security/advisory/typo3-ext-sa-2022-017