Ike.ninja

• Project: Joomla!
• SubProject: CMS
• Impact: Medium
• Severity: Low
• Versions: 3.0.0 through 3.8.7
• Exploit type: Session race condition
• Reported Date: 2017-July-08
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11324

Description

A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

• Links Go Here

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: Moderate
• Severity: Moderate
• Versions: 3.0.0 through 3.8.7
• Exploit type:XSS
• Reported Date:2018-February-02 & 2018-March-27
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11326

Description

Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

• You can find more details and other default changes in 3.8.8 at the Documentation.

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Moderate
• Versions: 3.1.0 through 3.8.7
• Exploit type: Information Disclosure
• Reported Date: 2018-April-27
• Fixed Date: 2018-May-22
• CVE Number: CVE-2018-11327

Description

Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission .

Affected Installs

Joomla! CMS versions 3.1.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Contact

The JSST at the Joomla! Security Centre.