CVE-2023-28732

Katalog CVE

CVSS 7.5 · High EPSS 0,63%

Kerentanan Improper Input Validation pada acymailing. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

Rincian

Terbit di NVD

30 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.bugbounty.ch/advisories/CVE-2023-28732 advisory pihak ketiga
• https://github.com/acyba/acymailing/releases/tag/v8.3.0 release notes
• https://www.acymailing.com/change-log/ release notes