CVE-2023-39971
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
CVE-2023-39971 describes an improper neutralization of input during web page generation vulnerability in the AcyMailing Enterprise component for Joomla, allowing for XSS attacks. This issue affects versions 6.7.0-8.6.3 of the component.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. This poses a significant security risk to the application and its users' data.
Recommendation
It is recommended to update the AcyMailing Enterprise component to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application is advisable to identify other potential threats.
Other vulnerabilities in AcyMailing Enterprise for Joomla
See all- CVE-2023-39974Medium
A vulnerability in the AcyMailing Enterprise component for Joomla allows unauthorized actors to obtain the number of subscribers in a specific list.
- CVE-2023-39973Medium
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.
- CVE-2023-39972Medium
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS