PT-2020-17364 · Joomla · Joomla!

Lee Thao + 1 · Published 2020-12-28 · Updated 2025-04-03 · CVE-2020-35612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 2.5.0 through 3.9.22

Description An issue was discovered in the folder parameter of mod random image, which lacked input validation, leading to a path traversal vulnerability.

Recommendations For Joomla! versions 2.5.0 through 3.9.22, update to a version that includes the fix for the path traversal vulnerability in the mod random image module. As a temporary workaround, consider restricting access to the mod random image module to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-JOOMLA-2020-35612

CVE-2020-35612

Affected Products

Joomla!

References · 5

• https://osv.dev/vulnerability/CVE-2020-35612 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2020-35612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35612 · Security Note
• https://developer.joomla.org/security-centre/830-20201103-core-path-traversal-in-mod-random-image.html · Vendor Advisory
• https://t.me/cibsecurity/21371 · Telegram Post