« Volver al listado

CVE-2024-45233

Estado: AnalizadaCrítica (9.8)—

An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

In2code — Powermail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45233",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45233",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-29T13:22:49.416138Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*"
          ],
          "vendor": "typo3",
          "product": "typo3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "12.4.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.5.0"
            },
            {
              "status": "unaffected",
              "version": "8.5.0"
            },
            {
              "status": "unaffected",
              "version": "10.9.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-29T00:15:09.293",
  "references": [
    {
      "url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-006",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en la extensión Powermail hasta la versión 12.3.5 para TYPO3. Se pueden llamar directamente varias acciones en OutputController debido a comprobaciones de acceso faltantes o implementadas de manera insuficiente, lo que da como resultado un control de acceso interrumpido. Según la configuración de los complementos de Powermail Frontend, un atacante no autenticado puede aprovechar esto para editar, actualizar, eliminar o exportar datos de formularios persistentes. Esto solo se puede aprovechar cuando se utilizan los complementos de Powermail Frontend. Las versiones corregidas son 7.5.0, 8.5.0, 10.9.0 y 12.4.0."
    }
  ],
  "lastModified": "2026-06-17T07:53:49.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:in2code:powermail:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B62C9C43-F43A-465C-B046-0CC44487DF0C",
              "versionEndExcluding": "7.5.0"
            },
            {
              "criteria": "cpe:2.3:a:in2code:powermail:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A816901-4C68-42FF-9096-204E2046A757",
              "versionEndExcluding": "8.5.0",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:in2code:powermail:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E21ABE99-FEC7-4155-BEB5-C76B842C492B",
              "versionEndExcluding": "10.9.0",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:in2code:powermail:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03F37EE5-5FCA-49B7-8D09-C397236264AD",
              "versionEndExcluding": "12.4.0",
              "versionStartIncluding": "12.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}