PT-2020-15182 · Ideas Portfolio S.A. De C.V.+1 · Jdownloads+1

Published 2020-09-25 · Updated 2020-09-28 · CVE-2020-19450

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Joomla! jdownloads version 3.2.63

Description A SQL injection issue exists in the jdownloads component for Joomla!. The getUserLimits function in the jdownloadshelper.php file is vulnerable, specifically via the list parameter.

Recommendations For version 3.2.63, consider disabling the getUserLimits function in the jdownloadshelper.php file as a temporary workaround until a patch is available. Restrict access to the com jdownloads component to minimize the risk of exploitation. Avoid using the list parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-19450

Affected Products

Joomla!

Jdownloads

References · 3

• https://osv.dev/vulnerability/CVE-2020-19450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19450 · Security Note
• http://cnvd.org.cn/flaw/show/CNVD-2019-09869 · Note