PT-2024-29023 · Joomla · Convert Forms

Published 2024-12-04 · Updated 2024-12-09 · CVE-2024-40744

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Convert Forms component for Joomla versions prior to 4.4.8

Description The issue is related to an unrestricted file upload via a security bypass in the Convert Forms component for Joomla. This allows for potential malicious file uploads without proper restrictions.

Recommendations For versions prior to 4.4.8, update to version 4.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload functionality in the Convert Forms component until the update can be applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-40744

Affected Products

Convert Forms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-40744 · Security Note
• https://osv.dev/vulnerability/CVE-2024-40744 · Vendor Advisory
• https://twitter.com/cracbot/status/1865999914192589022 · Twitter Post
• https://t.me/cvenotify/103171 · Telegram Post
• https://tassos.gr/joomla-extensions/convert-forms · Note
• https://twitter.com/CVEnew/status/1864332288017780928 · Twitter Post
• https://t.me/cvedetector/12007 · Telegram Post