• Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.6.2 - 3.9.10
  • Exploit type: Incorrect Access Control
  • Reported Date: 2019-April-09
  • Fixed Date: 2019-August-13
  • CVE Number: CVE-2019-XXXXX

Description

Inadequate checks in com_contact could allowed mail submission in disabled forms.

Affected Installs

Joomla! CMS versions 1.6.2 - 3.9.10

Solution

Upgrade to version 3.9.11

Contact

The JSST at the Joomla! Security Centre....

Reported By: Sergey Brester

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.9.7 - 3.9.8
  • Exploit type: Remote Code Execution
  • Reported Date: 2019-June-20
  • Fixed Date: 2019-July-09
  • CVE Number: TBA

Description

Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.

Affected Installs

Joomla! CMS versions 3.9.7 - 3.9.8

Solution

Upgrade to version 3.9.9

Contact

The JSST at the Joomla! Security Centre....

Reported By: Benjamin Trenkle, JSST

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.6.0 through 3.9.6
  • Exploit type: XSS
  • Reported Date: 2019-January-01
  • Fixed Date: 2019-June-11
  • CVE Number: CVE-2019-12766

Description

The subform fieldtype does not sufficiently filter or validate input of subfields, this leads to XSS attack vectors.

Affected Installs

Joomla! CMS versions 3.6.0 through 3.9.6

Solution

Upgrade to version 3.9.7

Contact

The JSST at the Joomla! Security Centre....

Reported By: Volkmar Schlothauer, ghsvs.de

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.8.13 through 3.9.6
  • Exploit type: Incorrect Access Control
  • Reported Date: 2019-April-10
  • Fixed Date: 2019-June-11
  • CVE Number: CVE-2019-12764

Description

The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.

Affected Installs

Joomla! CMS versions 3.8.13 through 3.9.6

Solution

Upgrade to version 3.9.7

Contact

The JSST at the Joomla! Security Centre....

 

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.9.0 through 3.9.6
  • Exploit type: CSV Injection
  • Reported Date: 2019-April-29
  • Fixed Date: 2019-June-11
  • CVE Number: CVE-2019-12765

Description

The CSV export of com_actionslogs is vulnerable to CSV injection.

Affected Installs

Joomla! CMS versions 3.9.0 through 3.9.6

Solution

Upgrade to version 3.9.7

Contact

The JSST at the Joomla! Security Centre....

Reported By: Jose Antonio Rodriguez Garcia and Phil Keeble (MWR InfoSecurity)

Read more

© 2019 Extly, CB - All rights reserved.