direct mail vulnerabilities and fixes

Recent CVEs affecting direct mail, with upgrade or downgrade steps. 4 tracked.

Also searched as: directmail.

direct mail has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2020-05-13. Highest priority: CVE-2020-12697 (score 41/100).

• CVE-2020-12700 MEDIUM 4.3 UPGRADE The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber da
• CVE-2020-12699 MEDIUM 6.1 UPGRADE The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
• CVE-2020-12698 MEDIUM 4.3 UPGRADE The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
• CVE-2020-12697 MEDIUM 5.3 UPGRADE The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.

FAQ

How do I fix direct mail vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is direct mail being exploited right now?

None of the tracked direct mail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which direct mail CVE should I patch first?

CVE-2020-12697 currently ranks highest (41/100): The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries..

RSS feed for direct mail · ← Back to latest CVEs