CVE-2020-12700

Description

The direct_mail extension for TYPO3 prior to version 5.2.4 contains an information disclosure vulnerability (CVE-2020-12700). The extension fails to check if an authenticated backend user has the necessary permissions to access pages containing newsletter subscriber data when using the 'Special Query' feature [3]. This missing access control check allows users to bypass intended restrictions.

Exploitation

An authenticated backend user can leverage the Special Query functionality to retrieve subscriber data from pages they do not have access to. The extension does not validate whether the user is authorized to view the underlying page records, thus allowing unauthorized querying. The data can then be exported via the CSV export function, making the information easily accessible [3].

Impact

Successful exploitation leads to the disclosure of newsletter subscriber information, which may include personal data such as names, email addresses, and other details stored in subscriber tables (e.g., tt_address, fe_users). This compromises the confidentiality of sensitive data and may violate privacy regulations [3].

Mitigation

The vulnerability is fixed in version 5.2.4 of the direct_mail extension. Users are advised to update to this version as soon as possible via the TYPO3 extension manager or by downloading the update from the TYPO3 extension repository [3]. No other workarounds have been provided.