CVE-2023-39974 Information disclosure in AcyMailing Enterprise component for Joomla
Unauthorized attackers can view the subscriber count for specific mailing lists in the AcyMailing Enterprise component for Joomla.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39974?
CVE-2023-39974 is a medium-severity vulnerability in acymailing.com AcyMailing Enterprise component for Joomla, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.
Which versions are affected by CVE-2023-39974?
It affects 1 product.
Products include Acymailing Acymailing.
How do I fix CVE-2023-39974?
No fix has been published for CVE-2023-39974 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-39974 being exploited?
There is no known exploitation of CVE-2023-39974 in the wild and no public exploit code.
Other vulnerabilities in acymailing.com AcyMailing Enterprise component for Joomla
- CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla
- CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla
- CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
- CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
- CVE-2024-7384 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Sources
Also known as GHSA-689r-whjg-rx75.