SB2017042502 - Multiple vulnerabilities in Joomla!
Published: April 25, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2017-7983)
The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to excessive data output when sending email messages via JMail API. A remote attacker can retrieve version of used PHPMailer from the email headers.
2) Cross-site scripting (CVE-ID: CVE-2017-7984)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the template manager component. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Cross-site scripting (CVE-ID: CVE-2017-7985)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing multibyte characters in various components. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Cross-site scripting (CVE-ID: CVE-2017-7986)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing specific HTML attributes. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Cross-site scripting (CVE-ID: CVE-2017-7987)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing file and folder names in the template manager component. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Improper access control (CVE-ID: CVE-2017-7988)
The disclosed vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to improper access control mechanisms. A remote authenticated user can overwrite can the author of an article.
7) Improper access control (CVE-ID: CVE-2017-7989)
The disclosed vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to improper mime type checks when processing file uploads. A remote authenticated user can bypass implemented security restrictions and upload arbitrary .swf files even if it is explicitly forbidden.
8) Information disclosure (CVE-ID: CVE-2017-8057)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The vulnerability exists due to improper error handling with enabled error reporting. A remote attacker can reveal full path to installation directory of the web application.
Remediation
Install update from vendor's website.