PT-2020-7465 · Joomla · Jomres

Jennifer Bornholt · Published 2020-01-02 · Updated 2020-01-09 · CVE-2013-3931

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Jomres (com jomres) versions prior to 7.3.1 for Joomla!

Description: A cross-site scripting (XSS) issue allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the property name parameter, related to editing property details.

Recommendations: For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the property name parameter when editing property details until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-3931

Affected Products

Jomres

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-3931 · Security Note
• https://joomlacorner.com/joomla-news/joomla-vulnerability-news/834-joomla-jomres-component-script-insertion-and-sql-injection-vulnerabilities.html · Note
• https://t.me/cibsecurity/8968 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86251 · Note
• http://securityfocus.com/bid/61634 · Note