PT-2016-7837 · Open Source Matters · Joomla!

Publicado 2016-12-16 · Atualizado 2016-12-22 · CVE-2016-9837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.5

Description An issue was discovered in the Beez3 layout override of the com content article view, where inadequate permissions checks allow users to view articles that should not be publicly accessible. This can be demonstrated by a request to the "index.php?option=com content&view=article&id=1&template=beez3" endpoint.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the com content article view until a patch is available. Avoid using the template parameter in the affected endpoint until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-9837

Produtos afetados

Joomla!

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9837 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9837 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9837 · Aviso do Fabricante
• http://securityfocus.com/bid/94892 · Nota
• https://joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html · Aviso do Fabricante