GHSA-m278-c6gg-4jrr

Source

https://github.com/advisories/GHSA-m278-c6gg-4jrr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m278-c6gg-4jrr/GHSA-m278-c6gg-4jrr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m278-c6gg-4jrr

Aliases

CVE-2014-3947

Published

2022-05-17T04:31:13Z

Modified

2025-04-14T17:42:11Z

Severity

8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

TYPO3 powermail extension has unrestricted file upload vulnerability

Details

Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-14T17:02:04Z",
    "nvd_published_at":  "2014-10-03T14:55:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / in2code/powermail

Package

Name: in2code/powermail
Purl: pkg:composer/in2code/powermail

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m278-c6gg-4jrr/GHSA-m278-c6gg-4jrr.json"

Packagist / in2code/powermail

Package

Name: in2code/powermail
Purl: pkg:composer/in2code/powermail

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m278-c6gg-4jrr/GHSA-m278-c6gg-4jrr.json"