CVE-2021-38302: 
PHP vulnerability analysis and mitigation

The Newsletter extension through version 4.0.0 for TYPO3 contains a SQL Injection vulnerability when processing bounced emails. The vulnerability was discovered in August 2021 and assigned CVE-2021-38302. The issue affects all versions up to and including 4.0.0 of the Newsletter extension (Vendor Advisory).

The vulnerability is classified as a SQL Injection with a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is tracked as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD).

The vulnerability could allow an attacker to execute arbitrary SQL commands in the context of the database user when processing bounced emails. This could potentially lead to unauthorized access, modification, or deletion of data in the database (Vendor Advisory).

Since the extension is unmaintained, the recommended mitigation is to completely uninstall and delete the extension folder from the TYPO3 installation. Users should search for alternative extensions in the TYPO3 Extension Repository. All vulnerable versions have been removed from the TYPO3 Extension Repository to prevent further downloads (Vendor Advisory).