PT-2018-14228 · Open Source Matters · Joomla!

Publicado 2018-10-09 · Atualizado 2022-05-13 · CVE-2018-17856

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.8.13

Description An issue in Joomla! allows the execution of arbitrary code through com joomlaupdate. By default, the ACL configuration enables Administrator-level users to access com joomlaupdate, which can trigger code execution.

Recommendations For versions prior to 3.8.13, update to version 3.8.13 or later to resolve the issue. As a temporary workaround, consider restricting access to com joomlaupdate for Administrator-level users until the update is applied.

Correção

Identificadores relacionados

CVE-2018-17856

GHSA-9M72-PW47-292W

Produtos afetados

Joomla!

Referências · 10

• https://github.com/joomla/joomla-cms · Nota
• http://securityfocus.com/bid/105559 · Nota
• https://osv.dev/vulnerability/CVE-2018-17856 · Aviso do Fabricante
• https://web.archive.org/web/20211208125303/http://securitytracker.com/id/1041914 · Nota
• https://developer.joomla.org/security-centre/752-20181002-core-inadequate-default-access-level-for-com-joomlaupdate.html · Aviso do Fabricante
• http://securitytracker.com/id/1041914 · Nota
• https://osv.dev/vulnerability/GHSA-9m72-pw47-292w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17856 · Nota de Segurança
• https://web.archive.org/web/20210124211736/http://securityfocus.com/bid/105559 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17856 · Nota