Vulnerability · Published Mar 30, 2023 · Assigned by NCSC.ch

CVE-2023-28732Missing access control affecting the AcyMailing plugin for Joomla

Medium 6.5

In plain English

A medium-severity improper input validation in Newsletter Plugin for Joomla from AcyMailing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 49.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

Affected products (as reported)

Vendor	Product	Versions
AcyMailing	Newsletter Plugin for Joomla	0 – before 8.3.0

Weakness: CWE-20, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References