[20240803] - Core - XSS in HTML Mail Templates

Project: Joomla!
SubProject: CMS
Impact: Moderate
Severity: Moderate
Probability: Moderate
Versions: 4.0.0-4.4.6, 5.0.0-5.1.2
Exploit type: XSS
Reported Date: 2024-07-22
Fixed Date: 2024-08-20
CVE Number: CVE-2024-27186

Description

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

Affected Installs

Joomla! CMS versions 4.0.0-4.4.6, 5.0.0-5.1.2

Solution

Upgrade to version 4.4.7 or 5.1.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Elysee Franchuk