Lucene search

MitreCVE-2019-16698

HistoryOct 16, 2019 - 7:15 p.m.

CVE-2019-16698

2019-10-1619:15:15

CWE-862

mitre

web.nvd.nist.gov

typo3

direct_mail

cve-2019-16698

security vulnerability

unauthorized access

frontend user data

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

Affected configurations

Nvd

Node

dkddirect_mailRange≤5.2.2typo3

VendorProductVersionCPE
dkddirect_mail*cpe:2.3:a:dkd:direct_mail:*:*:*:*:*:typo3:*:*

Vendor	Product	Version	CPE
dkd	direct_mail	*	cpe:2.3:a:dkd:direct_mail::::::typo3::*

References

extensions.typo3.org/extension/direct_mail

typo3.org/security/advisory/typo3-ext-sa-2019-016/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

Related for CVE-2019-16698