JRD Status: 

• 1 new submission, approved
• Approvals total: 460

Topics

Listing Verification Process: Richard presented a local installation demo to show an annual listing verification for the provider and how the information is captured in the database using Joomla’s core privacy suite plugins. Discovered that the workflow of the privacy suite does not match the necessary work flow for the JRD listing. The user cannot make corrections to their listings without approving the listing first. 

On the call:

1. Karen
2. Richard
3. Deb
4. Zehn

Next meeting:

• January 7, 2020: Topics to cover - what did we find regarding custom code that could be used for renewal process?
• January 21, 2020

• Project: Joomla!
• SubProject: CMS
• Impact: High
• Severity: Low
• Versions: 2.5.0 - 3.9.13
• Exploit type: SQL injection
• Reported Date: 2019-December-01
• Fixed Date: 2019-December-17
• CVE Number: CVE-2019-19846

Description

The lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

Affected Installs

Joomla! CMS versions 2.5.0 - 3.9.13

Solution

Upgrade to version 3.9.14

Contact

The JSST at the Joomla! Security Centre....

Joomla 3.9.14 is now available. This is a security fix release for the 3.x series of Joomla which addresses two security vulnerabilities and contains over 35 bug fixes and improvements....

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Low
• Versions: 3.8.0 - 3.9.13
• Exploit type: Path Disclosure
• Reported Date: 2019-November-22
• Fixed Date: 2019-December-17
• CVE Number: CVE-2019-19845

Description

Missing access check in framework files could lead to a path disclosure.

Affected Installs

Joomla! CMS versions 3.8.0 - 3.9.13

Solution

Upgrade to version 3.9.14

Contact

The JSST at the Joomla! Security Centre....