CVE-2022-47411

An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2022-017	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fp_newsletter_project:fp_newsletter::::::typo3::*
	cpe:2.3:a:fp_newsletter_project:fp_newsletter::::::typo3::*
	cpe:2.3:a:fp_newsletter_project:fp_newsletter::::::typo3::*
	cpe:2.3:a:fp_newsletter_project:fp_newsletter:1.2.0:::::typo3::
	cpe:2.3:a:fp_newsletter_project:fp_newsletter::::::typo3::*

Information

Published : 2022-12-14 13:15

Updated : 2022-12-16 14:11

NVD link : CVE-2022-47411

Mitre link : CVE-2022-47411

JSON object : View

CWE

CWE-668

Exposure of Resource to Wrong Sphere

Products Affected

fp_newsletter_project

fp_newsletter

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2022-017", "name": "https://typo3.org/security/advisory/typo3-ext-sa-2022-017", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-668"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-47411", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2022-12-14T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:fp_newsletter_project:fp_newsletter:*:*:*:*:*:typo3:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.2.6", "versionStartIncluding": "3.0.0"}, {"cpe23Uri": "cpe:2.3:a:fp_newsletter_project:fp_newsletter:*:*:*:*:*:typo3:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.4.0", "versionStartIncluding": "2.2.1"}, {"cpe23Uri": "cpe:2.3:a:fp_newsletter_project:fp_newsletter:*:*:*:*:*:typo3:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.1.2", "versionStartIncluding": "2.0.0"}, {"cpe23Uri": "cpe:2.3:a:fp_newsletter_project:fp_newsletter:1.2.0:*:*:*:*:typo3:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fp_newsletter_project:fp_newsletter:*:*:*:*:*:typo3:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.1.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-12-16T22:11Z"}

7.5 /10