What’s Vulnerable › Vulnerabilities
CVE-2024-45233
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-29 · updated 2026-06-17
- Weakness: CWE-284
Description
An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.
Affected products
- In2Code Powermail: before 7.5.0; from 8.0.0 before 8.5.0; from 9.0.0 before 10.9.0; from 12.0.0 before 12.4.0 — fixed in 10.9.0, 12.4.0, 7.5.0, 8.5.0
How to fix
Upgrade to a fixed version: In2Code Powermail 10.9.0, 12.4.0, 7.5.0, 8.5.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-45233 or the next vulnerability affects your stack