PT-2009-1773 · Open Source Matters · Joomla!

Publicado 2009-02-26 · Atualizado 2017-08-17 · CVE-2008-6299

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Joomla! versions 1.5.7 and earlier

Description: The issue allows remote authenticated users with certain privileges to inject arbitrary web script or HTML. This can be achieved via the title and description parameters to the com weblinks module and unspecified vectors in the com content module related to article submission.

Recommendations: For Joomla! versions 1.5.7 and earlier, consider updating to a version that is not affected by this issue. As a temporary workaround, restrict access to the com weblinks and com content modules to minimize the risk of exploitation. Avoid using the title and description parameters in the com weblinks module until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-6299

Produtos afetados

Joomla!

Referências · 9

• http://joomla.org/announcements/release-news/5219-joomla-158-released.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46523 · Nota
• http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/3104 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6299 · Nota de Segurança
• http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6299 · Nota
• http://secunia.com/advisories/32622 · Aviso do Fabricante
• http://securityfocus.com/bid/32263 · Nota