CVE-2023-28731 — Unauthenticated RCE affecting the AcyMailing plugin for Joomla

CVE-2023-28731

Unauthenticated RCE affecting the AcyMailing plugin for Joomla PUBLISHED

Description (CNA)

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected (CNA)

Vendor / product	Versions
AcyMailing / Newsletter Plugin for Joomla in the Enterprise version	affected 0 before 8.3.0

CWE

CWE-20, CWE-434

References

https://www.acymailing.com/change-log/
https://www.bugbounty.ch/advisories/CVE-2023-28731

ADP enrichment

CVE

No English description supplied.

https://www.acymailing.com/change-log/
https://www.bugbounty.ch/advisories/CVE-2023-28731

CISA-ADP

No English description supplied.

No references supplied.