{"id":"GHSA-q25c-r482-77p9","summary":"powermail TYPO3 extension has Insecure Direct Object Reference","details":"An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.","aliases":["CVE-2024-47047"],"modified":"2025-03-19T15:34:06.472568Z","published":"2024-09-17T15:31:23Z","database_specific":{"github_reviewed_at":"2024-09-17T21:29:11Z","nvd_published_at":"2024-09-17T14:15:17Z","cwe_ids":["CWE-639"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47047"},{"type":"WEB","url":"https://github.com/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575"},{"type":"WEB","url":"https://github.com/in2code-de/powermail/commit/682194d71a5f67fa39d899a9625ba69bb62f9bd8"},{"type":"WEB","url":"https://github.com/in2code-de/powermail/commit/91015da289111b86b8dbcb2553d5a722b944231e"},{"type":"WEB","url":"https://github.com/in2code-de/powermail/commit/bbadb8d7a71ddb469d07d106551938c91465b811"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-47047.yaml"},{"type":"PACKAGE","url":"https://github.com/in2code-de/powermail"},{"type":"WEB","url":"https://typo3.org/security/advisory/typo3-ext-sa-2024-007"}],"affected":[{"package":{"name":"in2code/powermail","ecosystem":"Packagist","purl":"pkg:composer/in2code/powermail"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1"}]}],"versions":["3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.18.0","3.18.1","3.18.2","3.19.0","3.2.0","3.20.0","3.21.0","3.21.1","3.22.0","3.22.1","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.3.1","4.3.2","4.3.3","4.3.4","4.3.5","4.4.0","5.0.0","5.0.1","5.1.0","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.4.0","5.5.0","5.6.0","6.0.0","6.1.0","6.2.0","7.0.0","7.1.0","7.2.0","7.3.0","7.3.1","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json"}},{"package":{"name":"in2code/powermail","ecosystem":"Packagist","purl":"pkg:composer/in2code/powermail"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.4.1","8.4.2","8.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json"}},{"package":{"name":"in2code/powermail","ecosystem":"Packagist","purl":"pkg:composer/in2code/powermail"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"10.9.1"}]}],"versions":["10.0.0","10.1.0","10.2.0","10.3.0","10.3.1","10.3.2","10.3.3","10.4.0","10.4.1","10.4.2","10.4.3","10.5.0","10.6.0","10.6.1","10.7.0","10.7.1","10.7.2","10.7.3","10.7.4","10.8.0","10.8.1","10.8.2","10.9.0","9.0.0","9.0.1","9.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json"}},{"package":{"name":"in2code/powermail","ecosystem":"Packagist","purl":"pkg:composer/in2code/powermail"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.4.1"}]}],"versions":["12.0.0","12.0.1","12.0.2","12.0.3","12.1.0","12.1.1","12.2.0","12.2.1","12.3.0","12.3.1","12.3.2","12.3.3","12.3.4","12.3.5","12.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}