Configuration Injection and Code Execution Vulnerability in TYPO3 Direct Mail Extension

CVE-2023-50461

What is CVE-2023-50461?

The Direct Mail extension for TYPO3 is susceptible to a configuration injection vulnerability due to improper handling of TSConfig within its Configuration backend module. This allows authenticated users to manipulate TSConfig pages for folders tied to Direct Mail. In versions of TYPO3 10.4 and later, such an exploit can lead to serious configuration issues, while earlier versions (up to 9.5) may allow attackers to execute arbitrary code. Affected users are those with a valid backend account and privileges to access the Direct Mail Configuration module.

References