--- title: "TYPO3-EXT-SA-2020-005: Multiple vulnerabilities in extension \"Direct Mail\" (direct_mail)" url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2020-005" description: "It has been discovered that the extension \"Direct Mail\" (direct_mail) is susceptible to Denial of Service, Broken Access Control, Open Redirect and Information Disclosure." image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - TYPO3 Extensions --- # TYPO3-EXT-SA-2020-005: Multiple vulnerabilities in extension "Direct Mail" (direct_mail) - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions) TYPO3-EXT-SA-2020-005: Multiple vulnerabilities in extension "Direct Mail" (direct\_mail) ========================================================================================= 12 May 2020 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the extension "Direct Mail" (direct\_mail) is susceptible to Denial of Service, Broken Access Control, Open Redirect and Information Disclosure. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/e4eaa13e33dd086a9c06f2570cb34609.jpeg)[Torben Hansen](https://news.typo3.com/article/author/torben-hansen) - Release Date: May 12, 2020 - Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. - Component: Direct Mail (ext:direct\_mail) - Vulnerability Type: Denial of Service, Broken Access Control, Open Redirect and Information Disclosure - Affected Versions: 5.2.3 and below - Severity: High - Suggested CVSS v3.1: [AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C&version=3.1) - References: [CVE-2020-12697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12697), [CVE-2020-12698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12698), [CVE-2020-12699](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12699) and [CVE-2020-12700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12700) ### Problem Description **Denial of Service (CVE-2020-12697)** The extension provides a functionality to log clicks on links in sent newsletters. This functionality does not limit the amount of log entries generated per link, so it is possible to use a valid link to fill the log table with a huge amount of records. **Broken Access Control (CVE-2020-12698)** The extension fails to check if an authenticated backend user has access to newsletter subscriber tables (e.g. tt\_address, fe\_users) when using the CSV export function of the extension. **Open Redirect (CVE-2020-12699)** The extension does not properly implement “jumpUrl” handling, resulting in an Open Redirect for links sent in newsletters. **Information Disclosure (CVE-2020-12700)** The extension fails to check if an authenticated backend user has access to pages with newsletter subscriber data when using the "Special query" feature. Exploiting this issue leads to information disclosure, since it is possible to use the CSV export function of the extension to export subscriber data from pages the backend user does not have access to. ### Solution An updated version 5.2.4  is available from the TYPO3 extension manager and at Users of the extension are advised to update the extension as soon as possible. ### Credits Thanks to Gernot Leitgab for reporting the Information Disclosure Issue, Kurt Dirnbauer for reporting the Open Redirect Issue, TYPO3 security team member Torben Hansen for reporting the Denial of Service Issue and Ivan Kartolo for reporting the Broken Access Control issue and providing a fixed version of the extension. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7cf52722a5b7183b29d378a2284bd103.jpeg) About the Author [Torben Hansen](https://news.typo3.com/article/author/torben-hansen) Open Source Enthusiast & TYPO3 Expert I’m a passionate open-source advocate and dedicated TYPO3 expert. As a freelancer, I offer professional TYPO3 services to clients while actively contributing to the TYPO3 ecosystem. I have developed several public TYPO3 extensions and serve as the Co-Lead of the TYPO3 Security Team, helping to enhance the platform’s security and functionality. For many years, I have been blogging about TYPO3, sharing insights and expertise with the community. [More posts by this author](https://news.typo3.com/article/author/torben-hansen)