There is always a great deal of Joomla! development activity underway and communicating with other developers in the community is essential. This site is a resource for anyone looking to build or maintain software based on the Joomla! platform.
Where to Start
- Project: Joomla!
- SubProject: CMS
- Impact: Critical
- Severity: Low
- Probability: Low
- Versions: 4.0.0-4.2.3
- Exploit type: Information Disclosure
- Reported Date: 2022-10-13
- Fixed Date: 2022-10-25
- CVE Number: CVE-2022-27912
Description
Joomla 4 sites with publicly enabled debug mode exposed data of previous requests.
Affected Installs
Joomla! CMS versions 4.0.0-4.2.3
Solution
Upgrade to version 4.2.4
Contact
The JSST at the Joomla! Security Centre.
Reported By: Peter Martin
- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Low
- Probability: Low
- Versions: 4.2.0
- Exploit type: Path Disclosure
- Reported Date: 2022-08-27
- Fixed Date: 2022-08-30
- CVE Number: CVE-2022-27911
Description
Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes done in 4.2.0. According to PROD2020/023 and in coordination with the JSST this has been patched in the public tracker vis #38615
Affected Installs
Joomla! CMS versions 4.2.0
Solution
Upgrade to version 4.2.1
Contact
The JSST at the Joomla! Security Centre.
Reported By: SharkyKZ
- Project: Joomla! / Joomla! Framework
- SubProject: CMS / archive
- Impact: Moderate
- Severity: Low
- Probability: Low
- Versions: 3.0.0 - 3.10.6 & 4.0.0 - 4.1.0
- Exploit type: Path Traversal
- Reported Date: 2022-02-20
- Fixed Date: 2022-03-29
- CVE Number: CVE-2022-23793
Description
Extracting an specifilcy crafted tar package could write files outside of the intended path.
Affected Installs
Joomla! CMS versions 3.0.0 - 3.10.6 & 4.0.0 - 4.1.0
Solution
Upgrade to version 3.10.7 or 4.1.1
Contact
The JSST at the Joomla! Security Centre.
Reported By: Egidio Romano