PT-2018-14227 · Open Source Matters · Joomla!

Paul Freeman · Published 2018-10-09 · Updated 2020-08-24 · CVE-2018-17855

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.8.13

Description An issue was discovered where an attacker who gains access to the mail account of a user authorized to approve admin verifications in the registration process can activate themselves as an admin.

Recommendations For versions prior to 3.8.13, update to version 3.8.13 or later to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-17855

Affected Products

Joomla!

References · 6

• https://developer.joomla.org/security-centre/754-20181004-core-acl-violation-in-com-users-for-the-admin-verification · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17855 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17855 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17855 · Note
• http://securitytracker.com/id/1041914 · Note
• http://securityfocus.com/bid/105559 · Note