Developer Network™

Download
Launch

There is always a great deal of Joomla! development activity underway and communicating with other developers in the community is essential. This site is a resource for anyone looking to build or maintain software based on the Joomla! platform.

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.7.0 through 3.9.5
  • Exploit type: XSS
  • Reported Date: 2019-April-29
  • Fixed Date: 2019-May-07
  • CVE Number: CVE-2019-11809

Description

The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.

Affected Installs

Joomla! CMS versions 1.7.0 through 3.9.5

Solution

Upgrade to version 3.9.6

Contact

The JSST at the Joomla! Security Centre.

Reported By: Jose Antonio Rodriguez Garcia and Phil Keeble (MWR InfoSecurity)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Versions: 3.0.0 through 3.9.4
  • Exploit type: XSS
  • Reported Date: 2019-March-25
  • Fixed Date: 2019-April-09
  • CVE Number: CVE-2019-11358

Description

The $.extend method of JQuery is vulnerable to Object.prototype pollution attacks.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Michał Gołębiowski-Owczarek, David Jardin (JSST)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: High
  • Versions: 3.2.0 through 3.9.4
  • Exploit type: ACL Violation
  • Reported Date: 2019-March-13
  • Fixed Date: 2019-April-08
  • CVE Number: CVE-2019-10946

Description

The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Benjamin Trenkle (JSST)