Vulnerability · Published Mar 30, 2023 · Assigned by NCSC.ch

CVE-2023-28731Unauthenticated RCE affecting the AcyMailing plugin for Joomla

Critical 9.8

In plain English

A critical-severity improper input validation in Newsletter Plugin for Joomla in the Enterprise version from AcyMailing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.8%top 21.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected products (as reported)

Vendor	Product	Versions
AcyMailing	Newsletter Plugin for Joomla in the Enterprise version	0 – before 8.3.0

Weakness: CWE-20, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References