Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: Version 1.5.4 and below
Vulnerability Type: Cross-Site Scripting
Release Date: 26.10.2010
Problem Description: Because of improper input validation and output encoding, powermail is susceptible to reflective Cross-Site Scripting. Exploitation requires an authenticated TYPO3 editor to follow a crafted malicious link.
Solution: An updated version 1.5.5 is available from the TYPO3 extension manager and at typo3.org/extensions/repository/view/powermail/1.5.5/. Users of the extension are advised to update the extension as soon as possible.
Credits: Credits go to Jeremy Lebourdais who discovered and reported the issues.