Medium severity5.3NVD Advisory· Published Aug 29, 2024· Updated Jun 17, 2026
CVE-2024-45232
CVE-2024-45232
Description
An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference (IDOR). An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the extension. This can only be exploited when the extension is configured to save submitted form data to the database (plugin.tx_powermail.settings.db.enable=1), which however is the default setting of the extension. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
in2code/powermailPackagist | >= 11.0.0, < 12.4.0 | 12.4.0 |
in2code/powermailPackagist | >= 9.0.0, < 10.9.0 | 10.9.0 |
in2code/powermailPackagist | >= 8.0.0, < 8.5.0 | 8.5.0 |
in2code/powermailPackagist | < 7.5.0 | 7.5.0 |
Affected products
2- TYPO3/powermaildescription
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-p652-xcgx-f85mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-45232ghsaADVISORY
- typo3.org/security/advisory/typo3-ext-sa-2024-006nvdThird Party AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-45232.yamlghsaWEB
- github.com/in2code-de/powermail/commit/061756732357206f2f13bf39a0676dd266ec9586ghsaWEB
- github.com/in2code-de/powermail/commit/ac402d4972c77dd119c8db6ffe594c15e8ae0bc5ghsaWEB
- github.com/in2code-de/powermail/commit/e2ddfaa06d29019d60be02b5a3da04b237ed760bghsaWEB
- github.com/in2code-de/powermail/commit/f58d70311799ae5f6acbec52ea9206d21eba91bbghsaWEB
News mentions
0No linked articles in our index yet.