CVE-2023-28733: Stored XSS affecting the AcyMailing plugin for Joomla

Published Mar 30, 2023

Updated

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected Software

1 affected component

AcyMailing Acymailing Joomla\!<8.3.0

Remediation

Information

update to a fixed version (>= 8.3.0)

Event History

Mar 30, 2023

CVE Published

via MITRE·11:27 AM

Data Sourced

via MITRE·11:27 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-28733?

CVE-2023-28733 is a vulnerability where AnyMailing Joomla Plugin is vulnerable to stored cross-site scripting (XSS) in templates and emails of AcyMailing.

How severe is CVE-2023-28733?

CVE-2023-28733 has a severity level of 6.1 (high).

What software versions are affected by CVE-2023-28733?

The AnyMailing Joomla Plugin Enterprise versions below 8.3.0 are affected by CVE-2023-28733.

How can CVE-2023-28733 be exploited?

CVE-2023-28733 can be exploited without authentication when access is granted to the campaign's creation on the front-office.

Is there a fix available for CVE-2023-28733?

Yes, upgrading to AnyMailing Joomla Plugin Enterprise version 8.3.0 or above will fix CVE-2023-28733.