CVE-2023-28732
CVSS V2 None
CVSS V3 None
Description
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.
Overview
- CVE ID
- CVE-2023-28732
- Assigner
- vulnerability@ncsc.ch
- Vulnerability Status
- Analyzed
- Published Version
- 2023-03-30T12:15:07
- Last Modified Date
- 2023-04-06T17:29:20
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\!:*:* | 1 | OR | 8.3.0 |
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/acyba/acymailing/releases/tag/v8.3.0 | Release Notes |
| https://www.acymailing.com/change-log/ | Release Notes |
| https://www.bugbounty.ch/advisories/CVE-2023-28732 | Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-28732 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28732 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 03:54:53 | Added to TrackCVE | |||
| 2023-04-17 03:54:56 | Weakness Enumeration | new |