CVE-2023-28733 Vulnerability Details

  /     /     /  

CVE-2023-28733 Metadata Quick Info

CVE Published: 30/03/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: NCSC.ch | Vendor: AcyMailing | Product: Newsletter Plugin for Joomla in the Enterprise version
Status : PUBLISHED

---

CVE-2023-28733 Description

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign\'s creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Metrics

CVSS Version: 3.1 | Base Score: 7.2 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* LOW
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-20
CWE Name: CWE-20 Improper Input Validation
Source: AcyMailing

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-63
CAPEC Description: CAPEC-63 Cross-Site Scripting (XSS)


Source: NVD (National Vulnerability Database).