CVE-2023-28731 (GCVE-0-2023-28731)
Vulnerability from cvelistv5 – Published: 2023-03-30 11:25 – Updated: 2025-02-11 20:11
VLAI
Title
Unauthenticated RCE affecting the AcyMailing plugin for Joomla
Summary
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected.
This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AcyMailing | Newsletter Plugin for Joomla in the Enterprise version |
Affected:
0 , < 8.3.0
(git)
|
Date Public
2023-03-30 10:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T13:43:23.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.acymailing.com/change-log/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.bugbounty.ch/advisories/CVE-2023-28731"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-11T20:10:51.852642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-11T20:11:00.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Newsletter Plugin for Joomla in the Enterprise version",
"vendor": "AcyMailing",
"versions": [
{
"lessThan": "8.3.0",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rapha\u00ebl Arrouas (Xel)"
},
{
"lang": "en",
"type": "coordinator",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Bug Bounty Switzerland"
}
],
"datePublic": "2023-03-30T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eAnyMailing Joomla Plugin is vulnerable to\u0026nbsp;unauthenticated remote code execution,\u0026nbsp;when being granted access to the campaign\u0027s creation on front-office due to unrestricted file upload allowing PHP code to be injected. \u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThis issue affects AnyMailing Joomla Plugin\u0026nbsp;Enterprise in versions below 8.3.0. \u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "AnyMailing Joomla Plugin is vulnerable to\u00a0unauthenticated remote code execution,\u00a0when being granted access to the campaign\u0027s creation on front-office due to unrestricted file upload allowing PHP code to be injected. \n\n\n\nThis issue affects AnyMailing Joomla Plugin\u00a0Enterprise in versions below 8.3.0. \n\n\n\n\n\n\n\n\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-30T11:25:36.854Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.acymailing.com/change-log/"
},
{
"url": "https://www.bugbounty.ch/advisories/CVE-2023-28731"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eupdate to a fixed version (\u0026gt;= 8.3.0)\u003c/p\u003e"
}
],
"value": "update to a fixed version (\u003e= 8.3.0)\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2023-02-01T11:00:00.000Z",
"value": "Reported"
},
{
"lang": "en",
"time": "2023-03-09T11:00:00.000Z",
"value": "Initial vendor notification "
},
{
"lang": "en",
"time": "2023-03-10T11:00:00.000Z",
"value": "Initial vendor response "
},
{
"lang": "en",
"time": "2023-03-20T11:00:00.000Z",
"value": "Releasion of fixed version"
},
{
"lang": "en",
"time": "2023-03-30T10:00:00.000Z",
"value": "Coordinated public disclosure "
}
],
"title": "Unauthenticated RCE affecting the AcyMailing plugin for Joomla",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePrevent the execution of PHP files in the thumbnail directory to prevent the injected code from being executed\u003c/p\u003e"
}
],
"value": "Prevent the execution of PHP files in the thumbnail directory to prevent the injected code from being executed\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2023-28731",
"datePublished": "2023-03-30T11:25:36.854Z",
"dateReserved": "2023-03-22T09:53:07.889Z",
"dateUpdated": "2025-02-11T20:11:00.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-28731",
"date": "2026-06-02",
"epss": "0.09064",
"percentile": "0.92792"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\\\\!:*:*\", \"versionEndExcluding\": \"8.3.0\", \"matchCriteriaId\": \"42A293DB-98EF-464D-BF05-6E47C6EED94C\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"AnyMailing Joomla Plugin is vulnerable to\\u00a0unauthenticated remote code execution,\\u00a0when being granted access to the campaign\u0027s creation on front-office due to unrestricted file upload allowing PHP code to be injected. \\n\\n\\n\\nThis issue affects AnyMailing Joomla Plugin\\u00a0Enterprise in versions below 8.3.0. \\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\"}]",
"id": "CVE-2023-28731",
"lastModified": "2024-11-21T07:55:53.507",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"vulnerability@ncsc.ch\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
"published": "2023-03-30T12:15:07.573",
"references": "[{\"url\": \"https://www.acymailing.com/change-log/\", \"source\": \"vulnerability@ncsc.ch\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://www.bugbounty.ch/advisories/CVE-2023-28731\", \"source\": \"vulnerability@ncsc.ch\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.acymailing.com/change-log/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://www.bugbounty.ch/advisories/CVE-2023-28731\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
"sourceIdentifier": "vulnerability@ncsc.ch",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"vulnerability@ncsc.ch\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}, {\"lang\": \"en\", \"value\": \"CWE-434\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-434\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-28731\",\"sourceIdentifier\":\"vulnerability@ncsc.ch\",\"published\":\"2023-03-30T12:15:07.573\",\"lastModified\":\"2024-11-21T07:55:53.507\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AnyMailing Joomla Plugin is vulnerable to\u00a0unauthenticated remote code execution,\u00a0when being granted access to the campaign\u0027s creation on front-office due to unrestricted file upload allowing PHP code to be injected. \\n\\n\\n\\nThis issue affects AnyMailing Joomla Plugin\u00a0Enterprise in versions below 8.3.0. \\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"vulnerability@ncsc.ch\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"vulnerability@ncsc.ch\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-434\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\\\\!:*:*\",\"versionEndExcluding\":\"8.3.0\",\"matchCriteriaId\":\"42A293DB-98EF-464D-BF05-6E47C6EED94C\"}]}]}],\"references\":[{\"url\":\"https://www.acymailing.com/change-log/\",\"source\":\"vulnerability@ncsc.ch\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://www.bugbounty.ch/advisories/CVE-2023-28731\",\"source\":\"vulnerability@ncsc.ch\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.acymailing.com/change-log/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://www.bugbounty.ch/advisories/CVE-2023-28731\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.acymailing.com/change-log/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.bugbounty.ch/advisories/CVE-2023-28731\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T13:43:23.737Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-28731\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T20:10:51.852642Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T20:10:27.463Z\"}}], \"cna\": {\"title\": \"Unauthenticated RCE affecting the AcyMailing plugin for Joomla\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Rapha\\u00ebl Arrouas (Xel)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Bug Bounty Switzerland\"}], \"impacts\": [{\"capecId\": \"CAPEC-242\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-242 Code Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"AcyMailing\", \"product\": \"Newsletter Plugin for Joomla in the Enterprise version\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.3.0\", \"versionType\": \"git\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-02-01T11:00:00.000Z\", \"value\": \"Reported\"}, {\"lang\": \"en\", \"time\": \"2023-03-09T11:00:00.000Z\", \"value\": \"Initial vendor notification \"}, {\"lang\": \"en\", \"time\": \"2023-03-10T11:00:00.000Z\", \"value\": \"Initial vendor response \"}, {\"lang\": \"en\", \"time\": \"2023-03-20T11:00:00.000Z\", \"value\": \"Releasion of fixed version\"}, {\"lang\": \"en\", \"time\": \"2023-03-30T10:00:00.000Z\", \"value\": \"Coordinated public disclosure \"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"update to a fixed version (\u003e= 8.3.0)\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eupdate to a fixed version (\u0026gt;= 8.3.0)\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2023-03-30T10:00:00.000Z\", \"references\": [{\"url\": \"https://www.acymailing.com/change-log/\"}, {\"url\": \"https://www.bugbounty.ch/advisories/CVE-2023-28731\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Prevent the execution of PHP files in the thumbnail directory to prevent the injected code from being executed\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003ePrevent the execution of PHP files in the thumbnail directory to prevent the injected code from being executed\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"AnyMailing Joomla Plugin is vulnerable to\\u00a0unauthenticated remote code execution,\\u00a0when being granted access to the campaign\u0027s creation on front-office due to unrestricted file upload allowing PHP code to be injected. \\n\\n\\n\\nThis issue affects AnyMailing Joomla Plugin\\u00a0Enterprise in versions below 8.3.0. \\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cp\u003eAnyMailing Joomla Plugin is vulnerable to\u0026nbsp;unauthenticated remote code execution,\u0026nbsp;when being granted access to the campaign\u0027s creation on front-office due to unrestricted file upload allowing PHP code to be injected. \u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThis issue affects AnyMailing Joomla Plugin\u0026nbsp;Enterprise in versions below 8.3.0. \u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434 Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"455daabc-a392-441d-aa46-37d35189897c\", \"shortName\": \"NCSC.ch\", \"dateUpdated\": \"2023-03-30T11:25:36.854Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-28731\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-11T20:11:00.208Z\", \"dateReserved\": \"2023-03-22T09:53:07.889Z\", \"assignerOrgId\": \"455daabc-a392-441d-aa46-37d35189897c\", \"datePublished\": \"2023-03-30T11:25:36.854Z\", \"assignerShortName\": \"NCSC.ch\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…