• Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.1.2 through 3.8.7
  • Exploit type: XSS
  • Reported Date: 2018-March-30
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11328


Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used), a lack of escaping the user-info component of the URI could result in a XSS vulnerability.

Affected Installs

Joomla! CMS versions 3.1.2 through 3.8.7


Upgrade to version 3.8.8


The JSST at the Joomla! Security Centre.

Reported By: David Jardin, JSST