[20240804] - Core - Improper ACL for backend profile view

Project: Joomla!
SubProject: CMS
Impact: Low
Severity: Moderate
Probability: Low
Versions: 4.0.0-4.4.6, 5.0.0-5.1.2
Exploit type: XSS
Reported Date: 2024-07-22
Fixed Date: 2024-08-20
CVE Number: CVE-2024-27187

Description

Improper Access Controls allows backend users to overwrite their username when disallowed.

Affected Installs

Joomla! CMS versions 4.0.0-4.4.6, 5.0.0-5.1.2

Solution

Upgrade to version 4.4.7 or 5.1.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Elysee Franchuk