PT-2018-14228 · Open Source Matters · Joomla!

Published 2018-10-09 · Updated 2022-05-13 · CVE-2018-17856

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.8.13

Description An issue in Joomla! allows the execution of arbitrary code through com joomlaupdate. By default, the ACL configuration enables Administrator-level users to access com joomlaupdate, which can trigger code execution.

Recommendations For versions prior to 3.8.13, update to version 3.8.13 or later to resolve the issue. As a temporary workaround, consider restricting access to com joomlaupdate for Administrator-level users until the update is applied.

Fix

Related Identifiers

CVE-2018-17856

GHSA-9M72-PW47-292W

Affected Products

Joomla!

References · 10

• https://osv.dev/vulnerability/CVE-2018-17856 · Vendor Advisory
• https://developer.joomla.org/security-centre/752-20181002-core-inadequate-default-access-level-for-com-joomlaupdate.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m72-pw47-292w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17856 · Security Note
• https://github.com/joomla/joomla-cms · Note
• http://securityfocus.com/bid/105559 · Note
• https://web.archive.org/web/20211208125303/http://securitytracker.com/id/1041914 · Note
• http://securitytracker.com/id/1041914 · Note
• https://web.archive.org/web/20210124211736/http://securityfocus.com/bid/105559 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17856 · Note