PT-2023-27183 · Joomla · Acymailing Enterprise

David Jardin · Publicado 2023-08-17 · Atualizado 2023-12-02 · CVE-2023-39971

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AcyMailing Enterprise component for Joomla versions 6.7.0 through 8.6.3

Description The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). This enables potential attackers to inject malicious scripts into web pages.

Recommendations For versions 6.7.0 through 8.6.3, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-39971

Produtos afetados

Acymailing Enterprise

Referências · 9

• https://acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1692271869896929353 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1692305936528871634 · Publicação no Twitter
• https://extensions.joomla.org/extension/acymailing-starter · Nota
• https://t.me/cibsecurity/68801 · Publicação no Telegram
• https://t.me/cvenotify/56827 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-39971 · Nota de Segurança
• https://t.me/cvenotify/61981 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39971 · Aviso do Fabricante