Allele Security Intelligence - TYPO3 extension Direct Mail (direct

ASA-2019-00585 – TYPO3 extension Direct Mail (direct_mail): Information Disclosure

Posted on October 22, 2019October 23, 2019 by Allele Security Intelligence in Alerts

A missing access check in the backend module of the extension allows a backend user without access to configured tables (e.g. fe_users, tt_address) to view and export data of users subscribed to a newsletter.