Archive for Joomla

285 results.

[20181004] – Core – ACL Violation in com_users for the admin verification

Oct09
by Ike on October 9, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.5.0 through 3.8.12
  • Exploit type: ACL Violation
  • Reported Date: 2017-December-27
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17855

Description

In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Paul Freeman

 Comment 

[20181003] – Core – Access level Violation in com_tags

Oct09
by Ike on October 9, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.1.0 through 3.8.12
  • Exploit type: ACL Violation
  • Reported Date: 2018-June-20
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17857

Description

Inadequate checks on the tags search fields can lead to an access level violation.

Affected Installs

Joomla! CMS versions 3.1.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Андрей Капитанов

 Comment 

[20181002] – Core – Inadequate default access level for com_joomlaupdate

Oct09
by Ike on October 9, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.4 through 3.8.12
  • Exploit type: Object Injection
  • Reported Date: 2018-June-21
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17856

Description

Joomla’s com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled access of Administrator-level users to access com_joomlaupdate and trigger a code execution.

Affected Installs

Joomla! CMS versions 2.5.4 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Codesafescan

 Comment 

[20181001] – Core – Hardening com_contact contact form

Oct09
by Ike on October 9, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 through 3.8.12
  • Exploit type: Incorrect Access Control
  • Reported Date: 2018-September-17
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17859

Description

Inadequate checks in com_contact could allowed mail submission in disabled forms.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin (JSST)

 Comment 

Joomla 3.8.13 Release

Oct09
by Ike on October 9, 2018 at 1:45 pm
Posted In: Uncategorized
joomla 3813 sr18

Joomla 3.8.13 is now available. This is a security release for the 3.x series of Joomla which addresses 5 security vulnerabilities.

 Comment 

Red alert, shields up – The work of the Joomla Security Team

Sep25
by Ike on September 25, 2018 at 9:00 am
Posted In: Uncategorized
Joomla Security Strike Team

A CMS-powered website has all the ingredients for an IT security nightmare: it is publicly accessible, it’s running on powerful machines with great connectivity and the underlying system is used countless times around the globe, making it an attractive target for attackers.
The Joomla Security Strike Team (JSST) is working hard to make sure that this nightmare doesn’t become reality for Joomla users!

 Comment 

Joomla 3.8.12 Release

Aug28
by Ike on August 28, 2018 at 1:45 pm
Posted In: Uncategorized
Joomla 3.8.12

Joomla 3.8.12 is now available. This is a security release for the 3.x series of Joomla which addresses 3 security vulnerabilities and contains over 20 bug fixes and improvements.

 Comment 

[20180803] – Core – ACL Violation in custom fields

Aug26
by Ike on August 26, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.7.0 through 3.8.11
  • Exploit type: ACL Violation
  • Reported Date: 2018-July-10
  • Fixed Date: 2018-August-28
  • CVE Number: CVE-2018-15881

Description

Inadequate checks regarding disabled fields can lead to an ACL violation.

Affected Installs

Joomla! CMS versions 3.7.0 through 3.8.11

Solution

Upgrade to version 3.8.12

Contact

The JSST at the Joomla! Security Centre.

Reported By: Elisa Foltyn, COOLCAT CREATIONS

 Comment 

[20180802] – Core – Stored XSS vulnerability in the frontend profile

Aug26
by Ike on August 26, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.5.0 through 3.8.11
  • Exploit type: XSS
  • Reported Date: 2018-July-10
  • Fixed Date: 2018-August-28
  • CVE Number: CVE-2018-15880

Description

Inadequate output filtering on the user profile page could lead to a stored XSS attack.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.11

Solution

Upgrade to version 3.8.12

Contact

The JSST at the Joomla! Security Centre.

Reported By: Roland Dalmulder, Perfect Web Team

 Comment 

[20180801] – Core – Hardening the InputFilter for PHAR stubs

Aug26
by Ike on August 26, 2018 at 1:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 1.5.0 through 3.8.11
  • Exploit type: Malicious file upload
  • Reported Date: 2018-August-23
  • Fixed Date: 2018-August-28
  • CVE Number: CVE-2018-15882

Description

Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.11

Solution

Upgrade to version 3.8.12

Contact

The JSST at the Joomla! Security Centre.

Reported By: Davide Tampellini

 Comment 

13 Reasons to Love Joomla!

Aug22
by Ike on August 22, 2018 at 11:30 am
Posted In: Uncategorized
joomla 13 birthday

13 years ago, we set out with a vision – to develop a CMS that stood firm on its Open Source values. Instantly, the community was behind us – with more than a thousand people joining our project within just one day. Fast forward 13 years and you could say that we’ve come a long way. 14 versions in (major/minor), Joomla! now powers millions of websites, with more than 7950 extensions lining the digital shelves of our extension directory.

 Comment 

Joomla 3.8.11 Release

Jul31
by Ike on July 31, 2018 at 1:45 pm
Posted In: Uncategorized
Joomla 3.8.11

Joomla 3.8.11 is now available. This is a bug fix release for the 3.x series of Joomla including over 35 bug fixes and improvements.

 Comment 

Joomla 3.8.10 Release

Jun26
by Ike on June 26, 2018 at 3:45 pm
Posted In: Uncategorized
joomla 3.8.10

Joomla 3.8.10 is now available. This is a bug fix release addressing one bug introduced into 3.8.9 which affects Windows servers.

 Comment 

Joomla 3.8.9 Release

Jun26
by Ike on June 26, 2018 at 1:40 pm
Posted In: Uncategorized
joomla 3.8.9

Joomla 3.8.9 is now available. This is a security release which addresses 2 security vulnerabilities and contains over 50 bug fixes and improvements.

 Comment 

[20180602] – Core – XSS vulnerability in language switcher module

Jun26
by Ike on June 26, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.6.0 through 3.8.8
  • Exploit type: XSS
  • Reported Date: 2018-May-07
  • Fixed Date: 2018-June-26
  • CVE Number: CVE-2018-12711

Description

In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page url.

Affected Installs

Joomla! CMS versions 1.6.0 through 3.8.8

Solution

Upgrade to version 3.8.9

Contact

The JSST at the Joomla! Security Centre.

Reported By: Borja Lorenzo, Innotecsystem

 Comment 

[20180601] – Core – Local File Inclusion with PHP 5.3

Jun26
by Ike on June 26, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.8.8
  • Exploit type: LFI
  • Reported Date: 2018-April-23
  • Fixed Date: 2018-June-26
  • CVE Number: CVE-2018-12712

Description

Our autoload code checks classnames to be valid, using the “class_exists” function in PHP. In PHP 5.3 this function validates invalid names as valid, which can result in a Local File Inclusion.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.8

Solution

Upgrade to version 3.8.9

Contact

The JSST at the Joomla! Security Centre.

Reported By: Davide Tampellini

 Comment 

Update on Joomla 4

Jun19
by Ike on June 19, 2018 at 12:25 pm
Posted In: Uncategorized
state of joomla 4

Following the release of Joomla 4.0 Alpha 3, the Joomla 4 Working Group has published below a status update on the anticipated release of Joomla 4.

 Comment 

On your marks, ready, set … Launch!

Jun13
by Ike on June 13, 2018 at 9:00 am
Posted In: Uncategorized
launch.joomla.org

The Joomla Project and CloudAccess.net are equally excited to announce the launch of launch.joomla.org, the brand new platform to launch a free Joomla website and test upcoming releases to support the project by helping make our CMS the best it can be.

 Comment 

Joomla 3.8.8 Release

May22
by Ike on May 22, 2018 at 1:45 pm
Posted In: Uncategorized
joomla 3.8.8

Joomla 3.8.8 is now available. This is a security release which addresses 9 security vulnerabilities, contains over 50 bug fixes, and includes various security related improvements.

 Comment 

[20180509] – Core – XSS vulnerability in the media manager

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.5.0 through 3.8.7
  • Exploit type: XSS
  • Reported Date: 2017-October-28
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-6378

Description

Inadequate filtering of file and folder names lead to various XSS attack vectors in the media manager.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin, JSST

 Comment 

[20180508] – Core – Possible XSS attack in the redirect method

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.1.2 through 3.8.7
  • Exploit type: XSS
  • Reported Date: 2018-March-30
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11328

Description

Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used), a lack of escaping the user-info component of the URI could result in a XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.1.2 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin, JSST

 Comment 

[20180507] – Core – Session deletion race condition

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Medium
  • Severity: Low
  • Versions: 3.0.0 through 3.8.7
  • Exploit type: Session race condition
  • Reported Date: 2017-July-08
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11324

Description

A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

  • Links Go Here

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin, JSST

 Comment 

[20180506] – Core – Filter field in com_fields allows remote code execution

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.7.0 through 3.8.7
  • Exploit type: Remote Code Execution
  • Reported Date: 2018-May-14
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11321

Description

Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.

Affected Installs

Joomla! CMS versions 3.7.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: Benjamin Trenkle, JSST

 Comment 

[20180505] – Core – XSS Vulnerabilities & additional hardening

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Versions: 3.0.0 through 3.8.7
  • Exploit type:XSS
  • Reported Date:2018-February-02 & 2018-March-27
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11326

Description

Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

Contact

The JSST at the Joomla! Security Centre.

Reported By: Kai Zhao of 3H Security Team & Zhouyuan Yang (FortiGuard Labs)

 Comment 

[20180504] – Core – Installer leaks plain text password to local user

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0 through 3.8.7
  • Exploit type: Information Disclosure
  • Reported Date: 2018-February-09
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11325

Description

The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and displays the plain text password for the administrator account at the confirmation screen.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sascha Egerer

 Comment 

[20180503] – Core – Information Disclosure about unpublished tags

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Versions: 3.1.0 through 3.8.7
  • Exploit type: Information Disclosure
  • Reported Date: 2018-April-27
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11327

Description

Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission .

Affected Installs

Joomla! CMS versions 3.1.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor, JSST

 Comment 

[20180502] – Core – Add PHAR files to the upload blacklist

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.0 through 3.8.7
  • Exploit type: Malicious file upload
  • Reported Date: 2018-March-14
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11322

Description

Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: Demis Palma, JSST

 Comment 

[20180501] – Core – ACL violation in access levels

May22
by Ike on May 22, 2018 at 1:30 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.0 through 3.8.7
  • Exploit type: ACL violation
  • Reported Date: 2018-March-08
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11323

Description

Inadequate checks allowed users to modify the access levels of user groups with higher permissions.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Reported By: Matias Aguirre, JSST

 Comment 

The Complete Guide to Your First Joomla! Installation from Plesk panel

May22
by Ike on May 22, 2018 at 12:48 pm
Posted In: Uncategorized

The post The Complete Guide to Your First Joomla! Installation from Plesk panel appeared first on Plesk.

 Comment 

Joomla 3.9 and Joomla 3.10

May08
by Ike on May 8, 2018 at 9:00 am
Posted In: Uncategorized
Joomla 3.9

As you most probably know, the General Data Protection Regulation (GDPR) will enter into force on 25 May, 2018.
Joomla, listening to its users, intends to integrate a Privacy Tool Suite in the Joomla CMS to facilitate the compliance of your sites and to make developers’ life easier to get their extensions compliant.

 Comment 

61 queries. 8.75 mb Memory usage. 2.204 seconds.