Developer Network™

Download
Launch

There is always a great deal of Joomla! development activity underway and communicating with other developers in the community is essential. This site is a resource for anyone looking to build or maintain software based on the Joomla! platform.

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: High
  • Versions: 3.2.0 through 3.9.4
  • Exploit type: ACL Violation
  • Reported Date: 2019-March-13
  • Fixed Date: 2019-April-08
  • CVE Number: CVE-2019-10946

Description

The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Benjamin Trenkle (JSST)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.5.0 through 3.9.4
  • Exploit type: Directory Traversal
  • Reported Date: 2019-March-13
  • Fixed Date: 2019-April-08
  • CVE Number: CVE-2019-10945

Description

The Media Manager component does not properly sanitise the folder parameter, allowing attackers to act outside the media manager root directory.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Haboob Research Team

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: High
  • Versions: 3.8.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-28
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9713

Description

The sample data plugins lack ACL checks, allowing unauthorized access.

Affected Installs

Joomla! CMS versions 3.8.0 through 3.9.3

Solution

Upgrade to version 3.9.4

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sven Hurt, Benjamin Trenkle