Vulnerability in In2code Powermail
CVE-2024-45233
An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.
EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- In2code Powermail
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2024-45233?
- CVE-2024-45233 is a critical-severity vulnerability in In2code Powermail, classified under Improper Access Control. CVSS score: 9.8/10. Published 2024-08-29.
- How severe is CVE-2024-45233?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2024-45233 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.