PT-2016-7838 · Open Source Matters · Joomla!

Cf · Publicado 2016-12-16 · Atualizado 2017-09-02 · CVE-2016-9838

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.5

Description An issue was discovered in the registration model of Joomla!, where incorrect filtering of registration form data stored in the session on a validation error allows a user to gain access to a registered user's account. This enables the attacker to reset the user's group mappings, username, and password by submitting a form that targets the registration.register task.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-9838

Produtos afetados

Joomla!

Referências · 6

• 🔥 https://exploit-db.com/exploits/41157 · Exploit
• https://osv.dev/vulnerability/CVE-2016-9838 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9838 · Nota de Segurança
• https://joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9838 · Nota
• http://securityfocus.com/bid/94893 · Nota