HIGH7.5

GHSA-4mh5-jj5w-3f9q

The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information

Quick fix

GHSA-4mh5-jj5w-3f9q — directmailteam/direct-mail: upgrade to the fixed version with the command below.

composer require directmailteam/direct-mail:^3.1.2

Details

The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/directmailteam/direct-mail

Introduced in: 0Fixed in: 3.1.2

Fixcomposer require directmailteam/direct-mail:^3.1.2

References

https://nvd.nist.gov/vuln/detail/CVE-2013-7400[ADVISORY]
https://extensions.typo3.org/extension/direct_mail[WEB]
https://github.com/kartolo/direct_mail[PACKAGE]
https://typo3.org/security/advisory/typo3-ext-sa-2013-014[WEB]
http://www.openwall.com/lists/oss-security/2014/09/11/4[WEB]