--- title: "TYPO3-EXT-SA-2014-004: Mass Assignment in extension Direct Mail Subscription (direct_mail_subscription)" url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2014-004" description: "It has been discovered that the extension \"Direct Mail Subscription\" (direct_mail_subscription) is susceptible to Mass Assignment." image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - TYPO3 Extensions --- # TYPO3-EXT-SA-2014-004: Mass Assignment in extension Direct Mail Subscription (direct_mail_subscription) - Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions) TYPO3-EXT-SA-2014-004: Mass Assignment in extension Direct Mail Subscription (direct\_mail\_subscription) ========================================================================================================= 12 February 2014 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the extension "Direct Mail Subscription" (direct\_mail\_subscription) is susceptible to Mass Assignment. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Marcus Krause](https://news.typo3.com/article/author/marcus-krause) **Release Date:** February 12, 2014 **Component Type:** Third party extension. This extension is not a part of the TYPO3 default installation. **Affected Versions:** Version 2.0.0 and below **Vulnerability Type:** Mass Assignment **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:P/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:P/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **Problem Description:** The extension Direct Mail Subscription bundles a vulnerable version of the old the feuser\_adminLib.inc library. This means that any links for creating records generated by this library can be manipulated to fill any field in the configured database table with arbitrary values. An attack is not limited to the fields listed in the configuration or the link itself. **Related CVE**: [CVE-2013-7075](http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/) **Solution:** An updated version 2.0.1 is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/download/direct\_mail\_subscription/2.0.1/t3x/](http://typo3.org/extensions/repository/download/direct_mail_subscription/2.0.1/t3x/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible. **General advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Initiates file download"). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Opens external link in new window") to receive future Security Bulletins via E-mail. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg) About the Author [Marcus Krause](https://news.typo3.com/article/author/marcus-krause) [More posts by this author](https://news.typo3.com/article/author/marcus-krause)