CVE-2024-47047
powermail TYPO3 extension has Insecure Direct Object Reference
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
- Record
CVE-2024-47047- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
CVE List
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
- Record
CVE-2024-47047- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
EUVDEUVD-2024-2850
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
- Record
EUVD-2024-2850- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q25c-r482-77p9
powermail TYPO3 extension has Insecure Direct Object Reference
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
- Record
GHSA-q25c-r482-77p9- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C - Weakness
- CWE-639
- Updated
- 2026-11-02
OSVGHSA-q25c-r482-77p9
powermail TYPO3 extension has Insecure Direct Object Reference
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.
- Record
GHSA-q25c-r482-77p9- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C - Weakness
- CWE-639
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
in2code/powermailPackagist |
before 7.5.1 | 7.5.1 |
in2code/powermailPackagist |
8.0.0 up to 8.5.1 | 8.5.1 |
in2code/powermailPackagist |
9.0.0 up to 10.9.1 | 10.9.1 |
in2code/powermailPackagist |
12.0.0 up to 12.4.1 | 12.4.1 |
in2code/powermailPackagist |
before 7.5.1, plus listed versions 3.10.03.10.13.11.03.11.13.11.2 Show 45 moreShow less3.12.03.13.03.14.03.15.03.16.03.17.03.18.03.18.13.18.23.19.03.2.03.20.03.21.03.21.13.22.03.22.13.3.03.4.03.5.03.6.03.7.03.8.03.9.04.0.04.0.14.0.24.1.04.2.04.3.04.3.14.3.24.3.34.3.44.3.54.4.05.0.05.0.15.1.05.2.05.2.15.2.25.3.05.3.15.3.25.4.0 |
7.5.1 |
in2code/powermailPackagist |
8.0.0 up to 8.5.1, plus listed versions 8.0.18.0.28.1.08.1.18.1.2 Show 15 moreShow less8.1.38.1.48.2.08.2.18.2.28.2.38.2.48.3.08.3.18.3.28.3.38.4.08.4.18.4.28.5.0 |
8.5.1 |
in2code/powermailPackagist |
9.0.0 up to 10.9.1, plus listed versions 10.0.010.1.010.2.010.3.010.3.1 Show 20 moreShow less10.3.210.3.310.4.010.4.110.4.210.4.310.5.010.6.010.6.110.7.010.7.110.7.210.7.310.7.410.8.010.8.110.8.210.9.09.0.19.0.2 |
10.9.1 |
in2code/powermailPackagist |
12.0.0 up to 12.4.1, plus listed versions 12.0.112.0.212.0.312.1.012.1.1 Show 9 moreShow less12.2.012.2.112.3.012.3.112.3.212.3.312.3.412.3.512.4.0 |
12.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47047 is a high vulnerability (CVSS 7.5) in In2code Powermail, published September 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in in2code/powermail 7.5.1.
References
typo3.org/security/advisory/typo3-ext-sa-2024-007
nvd.nist.gov/vuln/detail/CVE-2024-47047
github.com/in2code-de/powermail/commit/095a17637b6370aefd5390663cc11af47210f575
Left out here: 16 versions. The JSON record has them.