Ike.ninja

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Low
• Versions: 2.5.0 through 3.8.8
• Exploit type: LFI
• Reported Date: 2018-April-23
• Fixed Date: 2018-June-26
• CVE Number: CVE-2018-12712

Description

Our autoload code checks classnames to be valid, using the “class_exists” function in PHP. In PHP 5.3 this function validates invalid names as valid, which can result in a Local File Inclusion.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.8

Solution

Upgrade to version 3.8.9

Contact

The JSST at the Joomla! Security Centre.

Hello, all you lovely people out in third-party developerland! Don’t you hate it when you’re installing an SSL certificate through a script or API calls, but there’s some action that you want to take before or after the installation? Well, thanks to the hardworking folks on the Development Team, cPanel & WHM Version now includes a Standardized Hook for the SSL Installation event. What is a Standard Hook? Standardized Hooks are our way to help developers trigger events …

This post was originally added to our blog on Aug 18th, 2016. It has been updated for accuracy, and readability. In the blog post “Managing Multiple Domains from a Single Hosting Account,” we explain how to manage different domains you may own in a single cPanel hosting account. There may be certain circumstances or occasions where you will want to split off an addon domain into its own cPanel account. In the following blog post, …

This is the fourth in a series of blog posts around Git and a new feature in cPanel & WHM Version 72, Git Version Control. In case you missed them, there is a list at the bottom of this post. Keep watching for a new one every Wednesday!  If you follow our feature request site, you already know about our upcoming feature, Git™ Version Control. We’re designing it to make hosting repositories as easy …

The week of June 18th we will be removing PHP version 5.4 and 5.5 from all cPanel-provided EasyApache 4 profiles. To help users understand what to do, and how to react when that change occurs, we’ve put together a quick list of questions that we think will frequently be asked. What exactly will happen? The week of June 18th (likely on June 18th, but maybe June 19th), we will push an update for EasyApache 4 …

The cPanel backup system provides lots of flexibility, and one of its awesome features is the ability to create custom backup transports. In cPanel, a backup transport or destination is a method to move backups to a secondary/remote server for safe keeping. The custom backup transport feature allows you to specify a script which the backup system will pass arguments to; arguments common with uploading files in FTP, e.g. ‘put $filename’. Reading over the documentation, …

This is the second in a series of blog posts around Git and a new feature coming in version 72, Git Version Control. You can see the first here: What is Git? We got waylaid by the GDPR last week, but continue watching for a new one every Wednesday!  If you follow our feature request site, you already know about our upcoming feature, Git Version Control. We’re designing it to make hosting repositories as easy …

  Communication Re-Opt In We’ve been preparing in several ways to support our commitments to customers and end users. Per GDPR regulations and our data processing practices, if you wish to receive communications from cPanel moving forward, you must re-opt in by completing this form. GDPR cPanel has recently updated a number of its agreements to facilitate GDPR compliance.  We’ve done two things: We’ve revised our privacy policy …

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Low
• Versions: 1.5.0 through 3.8.7
• Exploit type: XSS
• Reported Date: 2017-October-28
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-6378

Description

Inadequate filtering of file and folder names lead to various XSS attack vectors in the media manager.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: Medium
• Severity: Low
• Versions: 3.0.0 through 3.8.7
• Exploit type: Session race condition
• Reported Date: 2017-July-08
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11324

Description

A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

• Links Go Here

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: Moderate
• Severity: Moderate
• Versions: 3.0.0 through 3.8.7
• Exploit type:XSS
• Reported Date:2018-February-02 & 2018-March-27
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11326

Description

Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

• You can find more details and other default changes in 3.8.8 at the Documentation.

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Moderate
• Versions: 3.1.0 through 3.8.7
• Exploit type: Information Disclosure
• Reported Date: 2018-April-27
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11327

Description

Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission .

Affected Installs

Joomla! CMS versions 3.1.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: High
• Severity: Low
• Versions: 2.5.0 through 3.8.7
• Exploit type: ACL violation
• Reported Date: 2018-March-08
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11323

Description

Inadequate checks allowed users to modify the access levels of user groups with higher permissions.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.

Greetings and Salutations! Hello everyone! My name is Phil, and I am the newest member of the Community team at cPanel! I’m very excited to join the Community Team and work with everyone who touches cPanel & WHM! I have worked in the web hosting industry for about 7 years. My roles have included frontline support, system administrator, and communications. I’ve been very lucky in taking two things that I love (arguing and the internet) …

As most any Hosting Provider will tell you, looking for new ways to promote services, gain more business, and earn new customers is one of the most important things they do every day. At the same time, both new and experienced cPanel users alike are visiting these Hosting Providers sites looking at what they’re offering. There are, of course, an unlimited number of reasons people shop around for new hosting, and those reasons are always evolving. …