CVE-2024-45232

An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference (IDOR). An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the extension. This can only be exploited when the extension is configured to save submitted form data to the database (plugin.tx_powermail.settings.db.enable=1), which however is the default setting of the extension. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0

• CWE-639
• CWE-639

• https://typo3.org/security/advisory/typo3-ext-sa-2024-006Third Party Advisory

Published

Aug 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45219Account users in Apache CloudStack by default are allowed to…8.5
• CVE-2024-4522A vulnerability classified as problematic was found in Campc…6.1
• CVE-2024-45229The Versa Director offers REST APIs for orchestration and ma…6.6
• CVE-2024-4523A vulnerability, which was classified as problematic, has be…6.1
• CVE-2024-45230An issue was discovered in Django 5.1 before 5.1.1, 5.0 befo…7.5
• CVE-2024-45231An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.1…5.3
• CVE-2024-45233An issue was discovered in powermail extension through 12.3.…9.8
• CVE-2024-45234An issue was discovered in Fort before 1.6.3. A malicious RP…7.5
• CVE-2024-45235An issue was discovered in Fort before 1.6.3. A malicious RP…7.5
• CVE-2024-45236An issue was discovered in Fort before 1.6.3. A malicious RP…7.5
• CVE-2024-45237An issue was discovered in Fort before 1.6.3. A malicious RP…9.8
• CVE-2024-45238An issue was discovered in Fort before 1.6.3. A malicious RP…7.5