VDB
Sign up
HIGH7.5

GHSA-vxmc-qg5x-pvfx

"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data

Quick fix

GHSA-vxmc-qg5x-pvfx — fixpunkt/fp-newsletter: upgrade to the fixed version with the command below.

composer require fixpunkt/fp-newsletter:^1.1.1

Details

An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/fixpunkt/fp-newsletter
Introduced in: 0Fixed in: 1.1.1
Fixcomposer require fixpunkt/fp-newsletter:^1.1.1
Packagist/fixpunkt/fp-newsletter
Introduced in: 1.2.0Fixed in: 2.1.2
Fixcomposer require fixpunkt/fp-newsletter:^2.1.2
Packagist/fixpunkt/fp-newsletter
Introduced in: 3.0.0Fixed in: 3.2.6
Fixcomposer require fixpunkt/fp-newsletter:^3.2.6

References