PT-2016-7837 · Open Source Matters · Joomla!

Published 2016-12-16 · Updated 2016-12-22 · CVE-2016-9837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.5

Description An issue was discovered in the Beez3 layout override of the com content article view, where inadequate permissions checks allow users to view articles that should not be publicly accessible. This can be demonstrated by a request to the "index.php?option=com content&view=article&id=1&template=beez3" endpoint.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the com content article view until a patch is available. Avoid using the template parameter in the affected endpoint until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-9837

Affected Products

Joomla!

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9837 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9837 · Vendor Advisory
• https://joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9837 · Note
• http://securityfocus.com/bid/94892 · Note