CVE-2023-28733

Summary

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper Input Validation
• CWE-116: CWE-116 Improper Encoding or Escaping of Output

ADP Enrichment

CVE Program Container

Additional References

• https://www.acymailing.com/change-log/
• https://www.bugbounty.ch/advisories/CVE-2023-28733

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.acymailing.com/change-log/
• https://www.bugbounty.ch/advisories/CVE-2023-28733

• ←Previous
• Next→