Multiple vulnerabilities in Joomla!



Risk Medium
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2018-17859
CVE-2018-17858
CVE-2018-17857
CVE-2018-17856
CVE-2018-17855
CWE-ID CWE-264
CWE-352
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Joomla!
Web applications / CMS

Vendor Joomla!

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU15312

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-17859

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to bypass security restrictions on the target system.

The vulnerability exists due to insufficient security checks in the com_contact contact form feature. A remote attacker can submit specially crafted mail using disabled forms to bypass security restrictions and conduct further attacks.

Mitigation

Update to version 3.8.13.

Vulnerable software versions

Joomla!: 2.5.0 - 3.8.12

CPE2.3 External links

https://developer.joomla.org/security-centre/751-20181001-core-hardening-com-contact-contact-form.ht...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site request forgery

EUVDB-ID: #VU15313

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-17858

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to perform CSRF attack.

The weakness exists due to insufficient CSRF protections in the back end of the com_installeractions. A remote attacker can create a specially crafted HTML page or URL, trick the victim into visiting it, gain access to the system and perform arbitrary actions

Mitigation

Update to version 3.8.13.

Vulnerable software versions

Joomla!: 2.5.0 - 3.8.12

CPE2.3 External links

https://developer.joomla.org/security-centre/755-20181005-core-csrf-hardening-in-com-installer.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security restrictions bypass

EUVDB-ID: #VU15314

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-17857

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to bypass security restrictions on the target system.

The vulnerability exists due to insufficient security checks of the tags search fields. A remote attacker can submit specially crafted mail using disabled forms to bypass security restrictions and conduct further attacks.

Mitigation

Update to version 3.8.13.

Vulnerable software versions

Joomla!: 3.0.4 - 3.8.12

CPE2.3 External links

https://developer.joomla.org/security-centre/753-20181003-core-access-level-violation-in-com-tags


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Remote code execution

EUVDB-ID: #VU15315

Risk: Medium

CVSSv4.0: 2.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Green]

CVE-ID: CVE-2018-17856

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote administrative attacker to execute arbitrary code on the target system.

The vulnerability exists due to the default ACL config. A remote attacker can access com_joomlaupdate and execute arbitrary code with elevated privileges.

Mitigation

Update to version 3.8.13.

Vulnerable software versions

Joomla!: 2.5.4 - 3.8.12

CPE2.3 External links

https://developer.joomla.org/security-centre/752-20181002-core-inadequate-default-access-level-for-com-joomlaupdate.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security restrictions bypass

EUVDB-ID: #VU15316

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-17855

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to ACL violation in com_users for the admin verification. A remote attacker can get access to the mail account of an user who can approve admin verifications in the registration process and activate himself.

Mitigation

Update to version 3.8.13.

Vulnerable software versions

Joomla!: 1.5 - 3.8.12

CPE2.3 External links

https://developer.joomla.org/security-centre/754-20181004-core-acl-violation-in-com-users-for-the-admin-verification


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###