CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
Explanation of Vulnerability in Simple Terms
AcyMailing Enterprise for Joomla versions before 8.3.0 contain an input validation flaw that allows unauthenticated attackers to run their own code on the site, read sensitive data, or disrupt service. No user interaction is required. The vulnerability affects all versions from 0 to 8.3.0.
What an attacker can do
Run code on the site, read sensitive data, or disrupt service without authentication.
Potential impact on your site
Attackers can compromise your Joomla site, steal data, or take it offline without needing a user account.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
