Posts Tagged Security Centre

84 results.

[20200802] – Core – Open redirect in com_content vote feature

Aug25
by Ike on August 25, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.20
  • Exploit type: Open Redirect
  • Reported Date: 2020-July-05
  • Fixed Date: 2020-August-25
  • CVE Number: CVE-2020-24598

Description

Lack of input validation in com_content leads to an open redirect.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre.

Reported By: Ahmad Kamaran Jamil

 Comment 

[20200803] – Core – Directory traversal in com_media

Aug25
by Ike on August 25, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0-3.9.20
  • Exploit type: Directory Traversal
  • Reported Date: 2020-February-02
  • Fixed Date: 2020-August-25
  • CVE Number: CVE-2020-24597

Description

Lack of input validation allows com_media root paths outside of the webroot.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

 Comment 

[20200801] – Core – XSS in mod_latestactions

Aug25
by Ike on August 25, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.9.0-3.9.20
  • Exploit type: XSS
  • Reported Date: 2020-August-21
  • Fixed Date: 2020-August-25
  • CVE Number: CVE-2020-24599

Description

Lack of escaping in mod_latestactions allows XSS attacks.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre.

Reported By: Peter Martin

 Comment 

[20200706] – Core – System Information screen could expose redis or proxy credentials

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.19
  • Exploit type: Information Disclosure
  • Reported Date: 2020-Jun-17
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15698

Description

Inadequate filtering in the system information screen could expose redis or proxy credentials

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

 Comment 

[20200705] – Core – Escape mod_random_image link

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.19
  • Exploit type: XSS
  • Reported Date: 2020-Jun-08
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15696

Description

Lack of input filtering and escaping allows XSS attacks in mod_random_image

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

 Comment 

[20200704] – Core – Variable tampering via user table class

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.19
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-Jun-02
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15697

Description

Internal read-only fields in the User table class could be modified by users.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

 Comment 

[20200703] – Core – CSRF in com_privacy remove-request feature

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.9.0-3.9.19
  • Exploit type: CSRF
  • Reported Date: 2020-May-07
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15695

Description

A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Bui Duc Anh Khoa from Viettel Cyber Security

 Comment 

[20200702] – Core – Missing checks can lead to a broken usergroups table record

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0-3.9.19
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-April-04
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15699

Description

Missing validation checks at the usergroups table object can result into an broken site configuration.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

 Comment 

[20200701] – Core – CSRF in com_installer ajax_install endpoint

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.7.0-3.9.19
  • Exploit type: CSRF
  • Reported Date: 2020-May-07
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-XXXXX

Description

A missing token check in the ajax_install endpoint com_installer causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.7.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Bui Duc Anh Khoa from Viettel Cyber Security

 Comment 

[20200605] – Core – CSRF in com_postinstall

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.7.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-May-08
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-13760

Description

Missing token checks in com_postinstall cause CSRF vulnerabilities.

Affected Installs

Joomla! CMS versions 3.7.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Khoa Bùi Đức Anh

 Comment 

[20200604] – Core – XSS in jQuery.htmlPrefilter

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Versions: 3.0.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-April-10
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-11022 and CVE-2020-11023

Description

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are “[…] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others.”

The Drupal project has backported the relevant fixes back to jQuery 1.x and Joomla has adopted that patch.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin, JSST

 Comment 

[20200603] – Core – XSS in com_modules tag options

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-May-06
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-XXX

Description

Incorrect input validation of the module tag option in com_modules allow XSS attacks.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

[20200602] – Core – Inconsistent default textfilter settings

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0-3.9.18
  • Exploit type: Insecure Permissions
  • Reported Date: 2020-April-23
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-13763

Description

The default settings of the global “textfilter” configuration doesn’t block HTML inputs for ‘Guest’ users. With 3.9.19, the textfilter for new installations has been set to ‘No HTML’ for the groups ‘Public’, ‘Guest’ and ‘Registered’.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Brian Teeman

 Comment 

[20200601] – Core – XSS in modules heading tag option

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-May-06
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-13761

Description

Lack of input validation in the heading tag option of the “Articles – Newsflash” and “Articles – Categories” modules allow XSS attacks.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Khoa Bùi Đức Anh

 Comment 

[20200403] – Core – Incorrect access control in com_users access level deletion function

Apr21
by Ike on April 21, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 – 3.9.16
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-March-13
  • Fixed Date: 2020-April-21
  • CVE Number: CVE-2020-11889

Description

Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.16

Solution

Upgrade to version 3.9.17

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

 Comment 

[20200402] – Core – Missing checks for the root usergroup in usergroup table

Apr21
by Ike on April 21, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 – 3.9.16
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-February-27
  • Fixed Date: 2020-April-21
  • CVE Number: CVE-2020-11890

Description

Inproper input validations in the usergroup table class could lead to a broken ACL configuration.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.16

Solution

Upgrade to version 3.9.17

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

 Comment 

[20200401] – Core – Incorrect access control in com_users access level editing function

Apr21
by Ike on April 21, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.8.8 – 3.9.16
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-March-13
  • Fixed Date: 2020-April-21
  • CVE Number: CVE-2020-11891

Description

Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.

Affected Installs

Joomla! CMS versions 3.8.8 – 3.9.16

Solution

Upgrade to version 3.9.17

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

 Comment 

[20200306] – Core – SQL injection in Featured Articles menu parameters

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 1.7.0-3.9.15
  • Exploit type: SQL Injection
  • Reported Date: 2020-March-9
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10243

Description

The lack of type casting of a variable in SQL statement leads to a SQL injection vulnerability in the “Featured Articles” frontend menutype.

Affected Installs

Joomla! CMS versions 1.7.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sam Thomas, Pentest.co.uk

 Comment 

[20200305] – Core – Incorrect Access Control in com_fields SQL field

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.7.0-3.9.15
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-February-28
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10239

Description

Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.

Affected Installs

Joomla! CMS versions 3.7.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: HOÀNG KIÊN

 Comment 

[20200304] – Core – Identifier collisions in com_users

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.0.0-3.9.15
  • Exploit type: Other
  • Reported Date: 2020-February-07
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10240

Description

Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

[20200303] – Core – Incorrect Access Control in com_templates

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.0-3.9.15
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-January-31
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10238

Description

Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: HOÀNG KIÊN

 Comment 

[20200302] – Core – XSS in Protostar and Beez3

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.15
  • Exploit type: XSS
  • Reported Date: 2020-February-24
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10242

Description

Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allow XSS attacks.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Pham Van Khanh

 Comment 

[20200301] – Core – CSRF in com_templates image actions

Mar10
by Ike on March 10, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.2.0-3.9.15
  • Exploit type: CSRF
  • Reported Date: 2020-February-06
  • Fixed Date: 2020-March-10
  • CVE Number: CVE-2020-10241

Description

Missing token checks in the image actions of com_templates causes CSRF vulnerabilities.

Affected Installs

Joomla! CMS versions 3.2.0 – 3.9.15

Solution

Upgrade to version 3.9.16

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoàng Kiên

 Comment 

[20200103] – Core – XSS in com_actionlogs

Jan28
by Ike on January 28, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.9.0-3.9.14
  • Exploit type: XSS
  • Reported Date: 2019-December-25
  • Fixed Date: 2020-January-28
  • CVE Number: CVE-2020-xxxxx

Description

Inadequate escaping of usernames allow XSS attacks in com_actionlogs.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.14

Solution

Upgrade to version 3.9.15

Contact

The JSST at the Joomla! Security Centre.

Reported By: Mayank Kumbhar from Techjoomla

 Comment 

[20200102] – Core – CSRF com_templates LESS compiler

Jan28
by Ike on January 28, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.0.0-3.9.14
  • Exploit type: CSRF
  • Reported Date: 2019-December-18
  • Fixed Date: 2020-January-28
  • CVE Number: CVE-2020-xxxxx

Description

A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.14

Solution

Upgrade to version 3.9.15

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

[20200101] – Core – CSRF in batch actions

Jan28
by Ike on January 28, 2020 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.14
  • Exploit type: CSRF
  • Reported Date: 2019-December-23
  • Fixed Date: 2020-January-28
  • CVE Number: CVE-2020-8419

Description

Missing token checks in the batch actions of various components causes CSRF vulnerabilities.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.14

Solution

Upgrade to version 3.9.15

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

[20191202] – Core – Various SQL injections through configuration parameters

Dec16
by Ike on December 16, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.0 – 3.9.13
  • Exploit type: SQL injection
  • Reported Date: 2019-December-01
  • Fixed Date: 2019-December-17
  • CVE Number: CVE-2019-19846

Description

The lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.13

Solution

Upgrade to version 3.9.14

Contact

The JSST at the Joomla! Security Centre.

Reported By: ka1n4t

 Comment 

[20191201] – Core – Path Disclosure in framework files

Dec16
by Ike on December 16, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.8.0 – 3.9.13
  • Exploit type: Path Disclosure
  • Reported Date: 2019-November-22
  • Fixed Date: 2019-December-17
  • CVE Number: CVE-2019-19845

Description

Missing access check in framework files could lead to a path disclosure.

Affected Installs

Joomla! CMS versions 3.8.0 – 3.9.13

Solution

Upgrade to version 3.9.14

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao, Viettel Cyber Security

 Comment 

[20191002] – Core – Path Disclosure in phpuft8 mapping files

Nov05
by Ike on November 5, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.6.0 – 3.9.12
  • Exploit type: Path Disclosure
  • Reported Date: 2019-November-01
  • Fixed Date: 2019-November-05
  • CVE Number: CVE-2019-18674

Description

Missing access check in the phputf8 mapping files could lead to an path disclosure.

Affected Installs

Joomla! CMS versions 3.6.0 – 3.9.12

Solution

Upgrade to version 3.9.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

 Comment 

[20191001] – Core – CSRF in com_template overrides view

Nov05
by Ike on November 5, 2019 at 1:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 3.2.0-3.9.12
  • Exploit type: CSRF
  • Reported Date: 2019-October-10
  • Fixed Date: 2019-November-05
  • CVE Number: CVE-2019-18650

Description

A missing token check in com_template causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 – 3.9.12

Solution

Upgrade to version 3.9.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

 Comment 

60 queries. 9.25 mb Memory usage. 1.753 seconds.