Read the docs
TI-2009-03944 Aliases CVE-2009-4159GHSA-7x6f-jvmg-6fgp

Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the…

Priority LOW 18CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Why it matters now

EPSS 0.00842 58th percentileScored 2026-11-07
Fix Fixed directmailteam/direct-mail (Packagist): 2.6.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—directmailteam/direct-mail (Packagist)before 2.6.52.6.5Patch availableGHSA-7x6f-jvmg-6fgp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • directmailteam/direct-mail (Packagist) Vendor— Affected before 2.6.5 Fixed in 2.6.5 Patch available GHSA-7x6f-jvmg-6fgp

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:ivan_kartolo:direct_mail:*:*:*:*:*:*:*:*up to 2.6.4VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.1.5:*:*:*:*:*:*:*2.1.5VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableIvan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:*:*:*:*:*:*:*:* Versions up to 2.6.4 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Ivan Kartolo
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ivan_kartolo:direct_mail:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableIvan Kartolo
cpe:2.3:a:ivan_kartolo:direct_mail:2.6.3:*:*:*:*:*:*:*2.6.3VulnerableIvan Kartolo
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*all versionsRunning onTYPO3
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:ivan_kartolo:direct_mail:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Ivan Kartolo
  • cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions all versions Running on ·TYPO3

Remediation

  • Fix · GHSA-7x6f-jvmg-6fgp directmailteam/direct-mail (Packagist) Fixed in 2.6.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4159
  2. 2026-10-03 Alias added: GHSA-7x6f-jvmg-6fgp

References

Patch 2

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences