VULNERABILITY INTELLIGENCE

CVE-2023-28732

CVSS score6.5 MEDIUM
EPSS probability0.63%
CISA KEVNot currently listed
Published2023-03-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

Weakness classification

  • vulnerability@ncsc.ch: CWE-20
  • nvd@nist.gov: CWE-22

Primary references