CVE-2019-16698: Missing Authorization

May 24, 2022 (updated July 18, 2023)

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

References

extensions.typo3.org/extension/direct_mail
github.com/advisories/GHSA-j2w4-45qm-r674
nvd.nist.gov/vuln/detail/CVE-2019-16698
typo3.org/security/advisory/typo3-ext-sa-2019-016/

Code Behaviors & Features

Detect and mitigate CVE-2019-16698 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →