High severity7.5NVD Advisory· Published Sep 17, 2024· Updated Jun 17, 2026
CVE-2024-47047
CVE-2024-47047
Description
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
in2code/powermailPackagist | < 7.5.1 | 7.5.1 |
in2code/powermailPackagist | >= 8.0.0, < 8.5.1 | 8.5.1 |
in2code/powermailPackagist | >= 9.0.0, < 10.9.1 | 10.9.1 |
in2code/powermailPackagist | >= 12.0.0, < 12.4.1 | 12.4.1 |
Affected products
1Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-q25c-r482-77p9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-47047ghsaADVISORY
- typo3.org/security/advisory/typo3-ext-sa-2024-007nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-47047.yamlghsaWEB
- github.com/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575ghsaWEB
- github.com/in2code-de/powermail/commit/682194d71a5f67fa39d899a9625ba69bb62f9bd8ghsaWEB
- github.com/in2code-de/powermail/commit/91015da289111b86b8dbcb2553d5a722b944231eghsaWEB
- github.com/in2code-de/powermail/commit/bbadb8d7a71ddb469d07d106551938c91465b811ghsaWEB
News mentions
0No linked articles in our index yet.