PT-2009-1773 · Open Source Matters · Joomla!

Published 2009-02-26 · Updated 2017-08-17 · CVE-2008-6299

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Joomla! versions 1.5.7 and earlier

Description: The issue allows remote authenticated users with certain privileges to inject arbitrary web script or HTML. This can be achieved via the title and description parameters to the com weblinks module and unspecified vectors in the com content module related to article submission.

Recommendations: For Joomla! versions 1.5.7 and earlier, consider updating to a version that is not affected by this issue. As a temporary workaround, restrict access to the com weblinks and com content modules to minimize the risk of exploitation. Avoid using the title and description parameters in the com weblinks module until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-6299

Affected Products

Joomla!

References · 9

• http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.html · Vendor Advisory
• http://vupen.com/english/advisories/2008/3104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6299 · Security Note
• http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.html · Vendor Advisory
• http://secunia.com/advisories/32622 · Vendor Advisory
• http://joomla.org/announcements/release-news/5219-joomla-158-released.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46523 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6299 · Note
• http://securityfocus.com/bid/32263 · Note