CVE-2023-28732: Missing access control affecting the AcyMailing plugin for Joomla

Published Mar 30, 2023

Updated

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

Affected Software

1 affected component

AcyMailing Acymailing Joomla\!<8.3.0

Remediation

Information

update to a fixed version (>= 8.3.0)

Event History

Mar 30, 2023

CVE Published

via MITRE·11:26 AM

Data Sourced

via MITRE·11:26 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-28732?

CVE-2023-28732 is a vulnerability in the AnyMailing Joomla Plugin that allows unauthorized access to sensitive files and system files via path traversal.

What is the severity of CVE-2023-28732?

The severity of CVE-2023-28732 is high, with a severity value of 7.5.

How does CVE-2023-28732 impact Acymailing Acymailing?

CVE-2023-28732 affects Acymailing Acymailing version up to 8.3.0.

How can I fix CVE-2023-28732?

To fix CVE-2023-28732, upgrade to version 8.3.0 or higher of the AnyMailing Joomla Plugin.

Where can I find more information about CVE-2023-28732?

You can find more information about CVE-2023-28732 on the following references: [GitHub](https://github.com/acyba/acymailing/releases/tag/v8.3.0) and [BugBounty.ch](https://www.bugbounty.ch/advisories/CVE-2023-28732).