• Project: Joomla!
• SubProject: CMS
• Impact: Moderate
• Severity: Low
• Versions: 3.9.0-3.9.20
• Exploit type: XSS
• Reported Date: 2020-August-21
• Fixed Date: 2020-August-25
• CVE Number: CVE-2020-24599

Description

Lack of escaping in mod_latestactions allows XSS attacks.

Affected Installs

Joomla! CMS versions 3.9.0 - 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre....

It's been busy times in the SMT. 

In June Davide officially stepped away from the team. We wish him all the very best in his new role as Team Leader for Joomla! Volunteer Engagement Team. He is also on several other teams. Thank you for all your help. It is a pleasure to work with you. 

In July Ed Hathaway resigned abruptly leaving Joomla totally. Ed ran our Joomlers account but could be counted on to step up and take care of any other posts that needed to be done. I've been filling in Joomlers since but having someone focused on it would be best. He is missed.

Aside from all our usual recent posts and since our last report we supported the J&Beyond event social promos, PBF, J Birthday and the semi-anual Thank You campaign to acknowledge the support of our partners and sponsors. This year we also included our Extension Partners. New graphics were made for