Archive for Joomla

285 results.

[20200306] – Core – SQL injection in Featured Articles menu parameters

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 1.7.0-3.9.15
  • Exploit type: SQL Injection
  • Reported Date: 2020-March-9
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10243

Description

The lack of type casting of a variable in SQL statement leads to a SQL injection vulnerability in the “Featured Articles” frontend menutype.

Affected Installs

Joomla! CMS versions 1.7.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sam Thomas, Pentest.co.uk

 Comment 

[20200305] – Core – Incorrect Access Control in com_fields SQL field

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.7.0-3.9.15
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-February-28
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10239

Description

Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.

Affected Installs

Joomla! CMS versions 3.7.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: HOÀNG KIÊN

 Comment 

[20200304] – Core – Identifier collisions in com_users

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.0.0-3.9.15
  • Exploit type: Other
  • Reported Date: 2020-February-07
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10240

Description

Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

[20200303] – Core – Incorrect Access Control in com_templates

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.0-3.9.15
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-January-31
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10238

Description

Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: HOÀNG KIÊN

 Comment 

[20200302] – Core – XSS in Protostar and Beez3

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.15
  • Exploit type: XSS
  • Reported Date: 2020-February-24
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10242

Description

Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allow XSS attacks.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Pham Van Khanh

 Comment 

[20200301] – Core – CSRF in com_templates image actions

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.2.0-3.9.15
  • Exploit type: CSRF
  • Reported Date: 2020-February-06
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10241

Description

Missing token checks in the image actions of com_templates causes CSRF vulnerabilities.

Affected Installs

Joomla! CMS versions 3.2.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoàng Kiên

 Comment 

Joomla 3.9.15 Release

Jan28
by Ike on January 28, 2020 at 2:00 pm
Posted In: Uncategorized
Joomla 3.9.15

Joomla 3.9.15 is now available. This is a security release for the 3.x series of Joomla which addresses three low security vulnerabilities and contains over 20 bug fixes and improvements.

 Comment 

[20200103] – Core – XSS in com_actionlogs

Jan28
by Ike on January 28, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.9.0-3.9.14
  • Exploit type: XSS
  • Reported Date: 2019-December-25
  • Fixed Date: 2020-January-28
  • CVE Number: CVE-2020-xxxxx

Description

Inadequate escaping of usernames allow XSS attacks in com_actionlogs.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.14

Solution

Upgrade to version 3.9.15

Contact

The JSST at the Joomla! Security Centre.

Reported By: Mayank Kumbhar from Techjoomla

 Comment 

[20200102] – Core – CSRF com_templates LESS compiler

Jan28
by Ike on January 28, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.0.0-3.9.14
  • Exploit type: CSRF
  • Reported Date: 2019-December-18
  • Fixed Date: 2020-January-28
  • CVE Number: CVE-2020-xxxxx

Description

A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.14

Solution

Upgrade to version 3.9.15

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

[20200101] – Core – CSRF in batch actions

Jan28
by Ike on January 28, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.14
  • Exploit type: CSRF
  • Reported Date: 2019-December-23
  • Fixed Date: 2020-January-28
  • CVE Number: CVE-2020-8419

Description

Missing token checks in the batch actions of various components causes CSRF vulnerabilities.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.14

Solution

Upgrade to version 3.9.15

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

Joomla 3.9.14 Release

Dec17
by Ike on December 17, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.14

Joomla 3.9.14 is now available. This is a security fix release for the 3.x series of Joomla which addresses two security vulnerabilities and contains over 35 bug fixes and improvements.

 Comment 

[20191202] – Core – Various SQL injections through configuration parameters

Dec16
by Ike on December 16, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.0 – 3.9.13
  • Exploit type: SQL injection
  • Reported Date: 2019-December-01
  • Fixed Date: 2019-December-17
  • CVE Number: CVE-2019-19846

Description

The lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.13

Solution

Upgrade to version 3.9.14

Contact

The JSST at the Joomla! Security Centre.

Reported By: ka1n4t

 Comment 

[20191201] – Core – Path Disclosure in framework files

Dec16
by Ike on December 16, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.8.0 – 3.9.13
  • Exploit type: Path Disclosure
  • Reported Date: 2019-November-22
  • Fixed Date: 2019-December-17
  • CVE Number: CVE-2019-19845

Description

Missing access check in framework files could lead to a path disclosure.

Affected Installs

Joomla! CMS versions 3.8.0 – 3.9.13

Solution

Upgrade to version 3.9.14

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao, Viettel Cyber Security

 Comment 

[20191002] – Core – Path Disclosure in phpuft8 mapping files

Nov05
by Ike on November 5, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.6.0 – 3.9.12
  • Exploit type: Path Disclosure
  • Reported Date: 2019-November-01
  • Fixed Date: 2019-November-05
  • CVE Number: CVE-2019-18674

Description

Missing access check in the phputf8 mapping files could lead to an path disclosure.

Affected Installs

Joomla! CMS versions 3.6.0 – 3.9.12

Solution

Upgrade to version 3.9.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

 Comment 

Joomla 3.9.13 Release

Nov05
by Ike on November 5, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.13

Joomla 3.9.13 is now available. This is a security fix release for the 3.x series of Joomla which addresses two security vulnerabilities and contains over 15 bug fixes and improvements.

 Comment 

[20191001] – Core – CSRF in com_template overrides view

Nov05
by Ike on November 5, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.2.0-3.9.12
  • Exploit type: CSRF
  • Reported Date: 2019-October-10
  • Fixed Date: 2019-November-05
  • CVE Number: CVE-2019-18650

Description

A missing token check in com_template causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 – 3.9.12

Solution

Upgrade to version 3.9.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

Joomla 3.9.12 Release

Sep24
by Ike on September 24, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.12

Joomla 3.9.12 is now available. This is a security fix release for the 3.x series of Joomla which addresses one security vulnerability and contains over 30 bug fixes and improvements.

 Comment 

[20190901] – Core – XSS in logo parameter of default templates

Sep24
by Ike on September 24, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.11
  • Exploit type: XSS
  • Reported Date: 2019-August-28
  • Fixed Date: 2019-September-24
  • CVE Number: CVE-2019-16725

Description

Inadequate escaping allowed XSS attacks using the logo parameter of the default templates.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.11

Solution

Upgrade to version 3.9.12

Contact

The JSST at the Joomla! Security Centre.

Reported By: Aswin M Guptha

 Comment 

Joomla 3.9.11 Release

Aug13
by Ike on August 13, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.11

Joomla 3.9.11 is now available. This is a security fix release for the 3.x series of Joomla which addresses one security vulnerability and contains over 25 bug fixes and improvements.

 Comment 

[20190801] – Core – Hardening com_contact contact form

Aug13
by Ike on August 13, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.6.2 – 3.9.10
  • Exploit type: Incorrect Access Control
  • Reported Date: 2019-April-09
  • Fixed Date: 2019-August-13
  • CVE Number: CVE-2019-XXXXX

Description

Inadequate checks in com_contact could allowed mail submission in disabled forms.

Affected Installs

Joomla! CMS versions 1.6.2 – 3.9.10

Solution

Upgrade to version 3.9.11

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sergey Brester

 Comment 

Joomla 3.9.10 Release

Jul10
by Ike on July 10, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.10

Joomla 3.9.10 is now available. This is a bug fix release for the 3.x series of Joomla which addresses one bug introduced into 3.9.9, affecting template styles of multilingual web sites.

 Comment 

Joomla 3.9.9 Release

Jul09
by Ike on July 9, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.9

Joomla 3.9.9 is now available. This is a security fix release for the 3.x series of Joomla which addresses one security vulnerability and contains over 30 bug fixes and improvements.

 Comment 

[20190701] – Core – Filter attribute in subform fields allows remote code execution

Jul09
by Ike on July 9, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.9.7 – 3.9.8
  • Exploit type: Remote Code Execution
  • Reported Date: 2019-June-20
  • Fixed Date: 2019-July-09
  • CVE Number: TBA

Description

Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.

Affected Installs

Joomla! CMS versions 3.9.7 – 3.9.8

Solution

Upgrade to version 3.9.9

Contact

The JSST at the Joomla! Security Centre.

Reported By: Benjamin Trenkle, JSST

 Comment 

YOYOW Foundation Becomes a Platinum Global Sponsor of Joomla!

Jul08
by Ike on July 8, 2019 at 11:00 am
Posted In: Uncategorized
yoyow sponsor

The YOYOW Foundation has become a Platinum Global Sponsor of Joomla. 

 Comment 

Joomla 3.9.8 Release

Jun11
by Ike on June 11, 2019 at 1:00 pm
Posted In: Uncategorized
Joomla 3.9.8

Joomla 3.9.8 is now available. This is a bug fix release for the 3.x series of Joomla which addresses one bug introduced into 3.9.7 which affects web sites using the French Help Server.

 Comment 

Joomla 3.9.7 Release

Jun11
by Ike on June 11, 2019 at 8:45 am
Posted In: Uncategorized
Joomla 3.9.7

Joomla 3.9.7 is now available. This is a security fix release for the 3.x series of Joomla which addresses three security vulnerabilities and contains over 40 bug fixes and improvements.

 Comment 

[20190603] – Core – ACL hardening of com_joomlaupdate

Jun11
by Ike on June 11, 2019 at 12:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.8.13 through 3.9.6
  • Exploit type: Incorrect Access Control
  • Reported Date: 2019-April-10
  • Fixed Date: 2019-June-11
  • CVE Number: CVE-2019-12764

Description

The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.

Affected Installs

Joomla! CMS versions 3.8.13 through 3.9.6

Solution

Upgrade to version 3.9.7

Contact

The JSST at the Joomla! Security Centre.

 

 Comment 

[20190602] – Core – XSS in subform field

Jun11
by Ike on June 11, 2019 at 12:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.6.0 through 3.9.6
  • Exploit type: XSS
  • Reported Date: 2019-January-01
  • Fixed Date: 2019-June-11
  • CVE Number: CVE-2019-12766

Description

The subform fieldtype does not sufficiently filter or validate input of subfields, this leads to XSS attack vectors.

Affected Installs

Joomla! CMS versions 3.6.0 through 3.9.6

Solution

Upgrade to version 3.9.7

Contact

The JSST at the Joomla! Security Centre.

Reported By: Volkmar Schlothauer, ghsvs.de

 Comment 

[20190601] – Core – CSV injection in com_actionlogs

Jun11
by Ike on June 11, 2019 at 12:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.9.0 through 3.9.6
  • Exploit type: CSV Injection
  • Reported Date: 2019-April-29
  • Fixed Date: 2019-June-11
  • CVE Number: CVE-2019-12765

Description

The CSV export of com_actionslogs is vulnerable to CSV injection.

Affected Installs

Joomla! CMS versions 3.9.0 through 3.9.6

Solution

Upgrade to version 3.9.7

Contact

The JSST at the Joomla! Security Centre.

Reported By: Jose Antonio Rodriguez Garcia and Phil Keeble (MWR InfoSecurity)

 Comment 

[20190502] – Core – By-passing protection of Phar Stream Wrapper Interceptor

May08
by Ike on May 8, 2019 at 12:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.9.3 through 3.9.5
  • Exploit type: Object Injection
  • Reported Date: 2019-March-27
  • Fixed Date: 2019-May-07

Description

In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. The used implementation however is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file.

Affected Installs

Joomla! CMS versions 3.9.3 through 3.9.5

Solution

Upgrade to version 3.9.6

Contact

The JSST at the Joomla! Security Centre.

Reported By: Daniel le Gall, Fix coordinated by Oliver Hader from TYPO3

 Comment 

61 queries. 8.75 mb Memory usage. 0.616 seconds.