PT-2012-4347 · Joomla · Joomla Content Editor

Published 2012-05-21 · Updated 2017-08-29 · CVE-2012-2901

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Joomla Content Editor (JCE) component versions prior to 2.1 for Joomla!

Description A cross-site scripting (XSS) issue exists in the Profile List of the Joomla Content Editor (JCE) component, allowing remote attackers to inject arbitrary web script or HTML via the search parameter to "administrator/index.php".

Recommendations For Joomla Content Editor (JCE) component versions prior to 2.1, update to version 2.1 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2901

Affected Products

Joomla Content Editor

References · 6

• http://secunia.com/secunia_research/2012-14 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2901 · Security Note
• http://secunia.com/advisories/49206 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75670 · Note
• http://joomlacontenteditor.net/news/item/jce-21-released?category_id=32 · Note
• http://securityfocus.com/bid/53559 · Note