PT-2018-18095 · Joomla · K2

Published 2018-02-28 · Updated 2024-08-05 · CVE-2018-7482

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions K2 component for Joomla! version 2.8.0

Description The issue allows an attacker to download arbitrary files due to Incorrect Access Control with directory traversal. This can be demonstrated by a request to "view=media&task=connector&cmd=file&target=l1 ../configuration.php&download=1", where the pathname ../configuration.php should be base64 encoded for a valid attack. The vendor disputes this issue, stating that only files under the media-manager path can be downloaded and that sensitive information does not belong there.

Recommendations For version 2.8.0, consider updating to version 2.8.1, which includes additional blocking of .php downloads to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the media-manager path to minimize the risk of downloading sensitive files. Avoid using the target parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-7482

Affected Products

K2

References · 5

• 🔥 https://exploit-db.com/exploits/44188 · Exploit
• https://joomlaworks.net/forum/forum-updates-other-resources/49046-false-cve-report-on-k2-v2-8-0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7482 · Security Note
• https://t.me/cvenotify/89131 · Telegram Post