Используя данный сайт, Вы даете свое согласие на использование нами Cookies с целью сбора статистики посещаемости сайта. Подробнее ×

Joomla Security News

Список известных уязвимостей Joomla, которые можно устранить.
Машинный перевод этой страницы на русский язык

[20190304] - Core - Missing ACL check in sample data plugins

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: High
  • Versions: 3.8.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-28
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9713

Description

The sample data plugins lack ACL checks, allowing unauthorized access.

Affected Installs

Joomla! CMS versions 3.8.0 through 3.9.3

Solution

Upgrade to version 3.9.4


[20190303] - Core - XSS in media form field

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-25
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9714

Description

The media form field lacks escaping, leading to a XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

Solution

Upgrade to version 3.9.4


[20190302] - Core - XSS in item_title layout

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-25
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9711

Description

The item_title layout in edit views lacks escaping, leading to a XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

Solution

Upgrade to version 3.9.4


[20190301] - Core - XSS in com_config JSON handler

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.2.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-March-04
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9712

Description

The JSON handler in com_config lacks input validation, leading to XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

Solution

Upgrade to version 3.9.4


[20190206] - Core - Implement the TYPO3 PHAR stream wrapper

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: Object Injection
  • Reported Date: 2019-January-18
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7743

Description

The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3


[20190205] - Core - XSS Issue in core.js writeDynaList

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-October-07
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7740

Description

Inadequate parameter handling in JS code could lead to an XSS attack vector.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3


[20190204] - Core - Stored XSS issue in the Global Configuration help url #2

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2019-January-16
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7741

Description

Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3


[20190203] - Core - Additional warning in the Global Configuration textfilter settings

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2019-January-17
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7739

Description

"No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior but might be unexpected for the user. An additional message is now shown in the configuration dialog.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3


[20190202] - Core - Browserside mime-type sniffing causes XSS attack vectors

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.0.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-September-24
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7742

Description

A combination of specific webserver configurations, in connection with specific file types and browserside mime-type sniffing causes a XSS attack vector.

Affected Installs

Joomla! CMS versions 1.0.0 through 3.9.2

Solution

Upgrade to version 3.9.3


[20190201] - Core - Lack of URL filtering in various core components

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-November-13
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7744

Description

Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3