Developer Network™

Download
Launch

Security Announcements

This feed provides announcements of resolved security issues in Joomla! software releases.

For more information about the Joomla! Security Strike Team (JSST) and its processes, please review our Security article.

To report potential security issues, please follow the guidelines in the above referenced article. Please note that we are only able to provide support for the Joomla! CMS, Joomla! Framework, and *.joomla.org network of websites.

You can subscribe to notifications from this feed through a RSS reader.

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.7.0 through 3.9.5
  • Exploit type: XSS
  • Reported Date: 2019-April-29
  • Fixed Date: 2019-May-07
  • CVE Number: CVE-2019-11809

Description

The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.

Affected Installs

Joomla! CMS versions 1.7.0 through 3.9.5

Solution

Upgrade to version 3.9.6

Contact

The JSST at the Joomla! Security Centre.

Reported By: Jose Antonio Rodriguez Garcia and Phil Keeble (MWR InfoSecurity)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Versions: 3.0.0 through 3.9.4
  • Exploit type: XSS
  • Reported Date: 2019-March-25
  • Fixed Date: 2019-April-09
  • CVE Number: CVE-2019-11358

Description

The $.extend method of JQuery is vulnerable to Object.prototype pollution attacks.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Michał Gołębiowski-Owczarek, David Jardin (JSST)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: High
  • Versions: 3.2.0 through 3.9.4
  • Exploit type: ACL Violation
  • Reported Date: 2019-March-13
  • Fixed Date: 2019-April-08
  • CVE Number: CVE-2019-10946

Description

The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Benjamin Trenkle (JSST)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.5.0 through 3.9.4
  • Exploit type: Directory Traversal
  • Reported Date: 2019-March-13
  • Fixed Date: 2019-April-08
  • CVE Number: CVE-2019-10945

Description

The Media Manager component does not properly sanitise the folder parameter, allowing attackers to act outside the media manager root directory.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.9.4

Solution

Upgrade to version 3.9.5

Contact

The JSST at the Joomla! Security Centre.

Reported By: Haboob Research Team

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: High
  • Versions: 3.8.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-28
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9713

Description

The sample data plugins lack ACL checks, allowing unauthorized access.

Affected Installs

Joomla! CMS versions 3.8.0 through 3.9.3

Solution

Upgrade to version 3.9.4

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sven Hurt, Benjamin Trenkle

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-25
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9714

Description

The media form field lacks escaping, leading to a XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

Solution

Upgrade to version 3.9.4

Contact

The JSST at the Joomla! Security Centre.

Reported By: Fouad Maakor

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-February-25
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9711

Description

The item_title layout in edit views lacks escaping, leading to a XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

Solution

Upgrade to version 3.9.4

Contact

The JSST at the Joomla! Security Centre.

Reported By: Fouad Maakor

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.2.0 through 3.9.3
  • Exploit type: XSS
  • Reported Date: 2019-March-04
  • Fixed Date: 2019-March-12
  • CVE Number: CVE-2019-9712

Description

The JSON handler in com_config lacks input validation, leading to XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

Solution

Upgrade to version 3.9.4

Contact

The JSST at the Joomla! Security Centre.

Reported By: Mario Korth, Hackmanit

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: Object Injection
  • Reported Date: 2019-January-18
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7743

Description

The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin (JSST)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-October-07
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7740

Description

Inadequate parameter handling in JS code could lead to an XSS attack vector.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Dimitris Grammatikogiannis

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2019-January-16
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7741

Description

Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2019-January-17
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7739

Description

"No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior but might be unexpected for the user. An additional message is now shown in the configuration dialog.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Raviraj Powar

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.0.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-September-24
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7742

Description

A combination of specific webserver configurations, in connection with specific file types and browserside mime-type sniffing causes a XSS attack vector.

Affected Installs

Joomla! CMS versions 1.0.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hanno Böck

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-November-13
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7744

Description

Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-December-05
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6262

Description

Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Mario Korth, Hackmanit

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-November-29
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6263

Description

Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Qualys WAF security team

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-December-04
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6261

Description

Inadequate escaping in com_contact leads to a stored XSS vulnerability

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-December-01
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6264

Description

Inadequate escaping in mod_banners leads to a stored XSS vulnerability.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 through 3.8.12
  • Exploit type: CSRF
  • Reported Date: 2018-September-26
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17858

Description

Added additional CSRF hardening in com_installer actions in the backend.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Raviraj A. Powar

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 1.5.0 through 3.8.12
  • Exploit type: ACL Violation
  • Reported Date: 2017-December-27
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17855

Description

In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Paul Freeman

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.1.0 through 3.8.12
  • Exploit type: ACL Violation
  • Reported Date: 2018-June-20
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17857

Description

Inadequate checks on the tags search fields can lead to an access level violation.

Affected Installs

Joomla! CMS versions 3.1.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Андрей Капитанов

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Versions: 2.5.4 through 3.8.12
  • Exploit type: Object Injection
  • Reported Date: 2018-June-21
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17856

Description

Joomla’s com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled access of Administrator-level users to access com_joomlaupdate and trigger a code execution.

Affected Installs

Joomla! CMS versions 2.5.4 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: Codesafescan

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 through 3.8.12
  • Exploit type: Incorrect Access Control
  • Reported Date: 2018-September-17
  • Fixed Date: 2018-October-02
  • CVE Number: CVE-2018-17859

Description

Inadequate checks in com_contact could allowed mail submission in disabled forms.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.8.12

Solution

Upgrade to version 3.8.13

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin (JSST)

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.7.0 through 3.8.11
  • Exploit type: ACL Violation
  • Reported Date: 2018-July-10
  • Fixed Date: 2018-August-28
  • CVE Number: CVE-2018-15881

Description

Inadequate checks regarding disabled fields can lead to an ACL violation.

Affected Installs

Joomla! CMS versions 3.7.0 through 3.8.11

Solution

Upgrade to version 3.8.12

Contact

The JSST at the Joomla! Security Centre.

Reported By: Elisa Foltyn, COOLCAT CREATIONS

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.5.0 through 3.8.11
  • Exploit type: XSS
  • Reported Date: 2018-July-10
  • Fixed Date: 2018-August-28
  • CVE Number: CVE-2018-15880

Description

Inadequate output filtering on the user profile page could lead to a stored XSS attack.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.11

Solution

Upgrade to version 3.8.12

Contact

The JSST at the Joomla! Security Centre.

Reported By: Fouad Maakor

Page 7 of 13