- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Low
- Probability: Low
- Versions: 3.0.0-3.10.16-elts, 4.0.0-4.4.6, 5.0.0-5.1.2
- Exploit type: Cache Poisoning
- Reported Date: 2024-05-23
- Fixed Date: 2024-08-20
- CVE Number: CVE-2024-27185
Description
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
Affected Installs
Joomla! CMS versions 3.0.0-3.10.16-elts, 4.0.0-4.4.6, 5.0.0-5.1.2
Solution
Upgrade to version 3.10.17-elts, 4.4.7 or 5.1.3
Contact
The JSST at the Joomla! Security Centre.
Reported By: Shane Edwards