VulnerabilityModified
CVE-2023-28733
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.
MEDIUM 6.1EPSS 0.37%
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-116, CWE-79
- Affected
- acymailing/acymailing
- Source
- vulnerability@ncsc.ch
References
- https://www.acymailing.com/change-log/Release Notes
- https://www.bugbounty.ch/advisories/CVE-2023-28733Third Party Advisory
- https://www.acymailing.com/change-log/Release Notes
- https://www.bugbounty.ch/advisories/CVE-2023-28733Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.