Lucene search

JoomlaCVE-2023-39970

HistoryAug 17, 2023 - 9:15 p.m.

CVE-2023-39970

2023-08-1721:15:09

CWE-434

Joomla

web.nvd.nist.gov

cve-2023-39970

acymailing

joomla

unrestricted upload

file vulnerability

remote code execution

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.

Affected configurations

Nvd

Node

acybaacymailing_starterRange6.7.0–8.5.0joomla\!

VendorProductVersionCPE
acybaacymailing_starter*cpe:2.3:a:acyba:acymailing_starter:*:*:*:*:*:joomla\!:*:*

Vendor	Product	Version	CPE
acyba	acymailing_starter	*	cpe:2.3:a:acyba:acymailing_starter::::::joomla\!::*

CNA Affected

[
  {
    "collectionURL": "https://extensions.joomla.org/extension/acymailing-starter/",
    "defaultStatus": "unaffected",
    "packageName": "com_acymailing",
    "product": "AcyMailing component for Joomla",
    "vendor": "acymailing.com",
    "versions": [
      {
        "status": "affected",
        "version": "6.7.0-8.5.0"
      }
    ]
  }
]

References

extensions.joomla.org/extension/acymailing-starter/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

Related for CVE-2023-39970