CVE-2023-28733

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28733
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.acymailing.com/change-log/ Release Notes
https://www.bugbounty.ch/advisories/CVE-2023-28733 Third Party Advisory
https://www.acymailing.com/change-log/ Release Notes
https://www.bugbounty.ch/advisories/CVE-2023-28733 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\!:*:*
History

21 Nov 2024, 07:55

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 7.2
References () https://www.acymailing.com/change-log/ - Release Notes () https://www.acymailing.com/change-log/ - Release Notes
References () https://www.bugbounty.ch/advisories/CVE-2023-28733 - Third Party Advisory () https://www.bugbounty.ch/advisories/CVE-2023-28733 - Third Party Advisory

07 Nov 2023, 04:10

Type Values Removed Values Added
Summary AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0. AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

06 Apr 2023, 17:30

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
First Time Acymailing
Acymailing acymailing
References (MISC) https://www.bugbounty.ch/advisories/CVE-2023-28733 - (MISC) https://www.bugbounty.ch/advisories/CVE-2023-28733 - Third Party Advisory
References (MISC) https://www.acymailing.com/change-log/ - (MISC) https://www.acymailing.com/change-log/ - Release Notes
CPE cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\!:*:*

30 Mar 2023, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-30 12:15

Updated : 2024-11-21 07:55

NVD link : CVE-2023-28733

Mitre link : CVE-2023-28733

CVE.ORG link : CVE-2023-28733

JSON object : View

Products Affected

acymailing

  • acymailing
CWE
CWE-20

Improper Input Validation

CWE-116

Improper Encoding or Escaping of Output

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')