CVE-2020-12699: 
PHP vulnerability analysis and mitigation

The direct_mail extension through version 5.2.3 for TYPO3 contains an Open Redirect vulnerability via jumpUrl functionality. This vulnerability was disclosed on May 12, 2020, and was assigned identifier CVE-2020-12699 (MITRE, TYPO3).

The vulnerability stems from improper implementation of the 'jumpUrl' handling mechanism in the direct_mail extension, which can result in an Open Redirect for links sent in newsletters. The vulnerability has been assigned a High severity rating (TYPO3).

When exploited, this vulnerability allows attackers to perform open redirect attacks through links sent in newsletters, potentially leading to phishing attacks or directing users to malicious websites (TYPO3).

The vulnerability can be exploited through the newsletter system's link handling mechanism, specifically targeting the jumpUrl functionality. The attack vector is network-accessible and requires no special privileges or user interaction (TYPO3).

The vulnerability has been fixed in version 5.2.4 of the direct_mail extension. Users are advised to update to this version as soon as possible. The updated version is available through the TYPO3 extension manager and can be downloaded directly from the TYPO3 extension repository (TYPO3).