CVE-2023-28732CWE-20CWE-200

Missing access control affecting the AcyMailing plugin for Joomla

Medium · published March 30, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00633 · 49.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-03-30T11:26Z
EPSS history
Timeline
  • 30 MAR 11:26Z
    Missing access control affecting the AcyMailing plugin for Joomla
    cvelistv5