bihor/fp_newsletter · Security
"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data
- GHSA ID
- GHSA-r44w-pfx8-28jv
- CVE ID
- CVE-2022-47411
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-668 · Exposure of Resource to Wrong Sphere