Riskcovery

CVE-2023-28732

Missing access control affecting the AcyMailing plugin for Joomla

State
Published
Severity
6.5 Medium
Published
Mar 30, 2023
Updated
Feb 11, 2025
Reserved
Mar 22, 2023

Read the record on cve.org

Description

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NNCSC.ch

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
Newsletter Plugin for JoomlaAcyMailing
  • before 8.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.