Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-j2w4-45qm-r674
Advisory ID github_osv/GHSA-j2w4-45qm-r674
Aliases CVE-2019-16698
Summary direct_mail for Typo3 sensitive data exposure The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.
Status Published
Exploitability 0.5
Weighted Severity 3.9
Risk 1.9
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
cvssv3.1 4.3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j2w4-45qm-r674/GHSA-j2w4-45qm-r674.json
generic_textual MODERATE
Reference id Reference type URL
https://extensions.typo3.org/extension/direct_mail
https://github.com/kartolo/direct_mail
https://github.com/kartolo/direct_mail/commit/3a70924777294c7fb40e9f6eb3f7627bac58dfd1
https://typo3.org/security/advisory/typo3-ext-sa-2019-016
CVE-2019-16698 https://nvd.nist.gov/vuln/detail/CVE-2019-16698
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j2w4-45qm-r674/GHSA-j2w4-45qm-r674.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.