CVE-2024-47047

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Sep 17, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-470485.4Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketpla CVE-2024-470498.2The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl CVE-2024-47055.4The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all ver CVE-2024-470506.1Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.CVE-2024-470519.9This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploi CVE-2024-470537.7This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthori CVE-2024-470554.3SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows an CVE-2024-470565.1SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a CVE-2024-470575.3SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability co CVE-2024-470584.8With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive CVE-2024-470594.3When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. CVE-2024-47066.4The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '