PT-2020-7885 · Joomla · Jnews Joomla

Fábio Pires + 2 · Published 2020-03-09 · Updated 2020-03-10 · CVE-2015-7341

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: JNews Joomla Component versions prior to 8.5.0

Description: The issue allows for arbitrary file upload, which can be achieved via Subscribers or Templates. This is demonstrated by the ability to upload files with the .php5 extension.

Recommendations: For versions prior to 8.5.0, update to version 8.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload functionality in the Subscribers and Templates sections until the update is applied. Avoid using the file upload feature in these sections with untrusted users.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-7341

Affected Products

Jnews Joomla

References · 3

• 🔥 https://labs.integrity.pt/advisories/cve-2015-7341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7341 · Security Note
• https://t.me/cibsecurity/10385 · Telegram Post