PT-2016-7838 · Open Source Matters · Joomla!

Cf · Published 2016-12-16 · Updated 2017-09-02 · CVE-2016-9838

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.5

Description An issue was discovered in the registration model of Joomla!, where incorrect filtering of registration form data stored in the session on a validation error allows a user to gain access to a registered user's account. This enables the attacker to reset the user's group mappings, username, and password by submitting a form that targets the registration.register task.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-9838

Affected Products

Joomla!

References · 6

• 🔥 https://exploit-db.com/exploits/41157 · Exploit
• https://osv.dev/vulnerability/CVE-2016-9838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9838 · Security Note
• https://joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9838 · Note
• http://securityfocus.com/bid/94893 · Note