#VU12981 Code injection in Joomla!


Published: 2018-05-22 | Updated: 2018-05-23

Vulnerability identifier: #VU12981

Vulnerability risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11321

CWE-ID: CWE-94

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Joomla!
Web applications / CMS

Vendor: Joomla!

Description

The vulnerability allows a remote authenticated attacker to inject and execute arbitrary code.

The vulnerability exists due to improper validation of user-supplied data in com_fields core component. A remote authenticated attacker with privileges to create custom fields can inject an unvalidated option.

Mitigation
Upgrade to version 3.8.8.

Vulnerable software versions

Joomla!: 3.8.0 - 3.8.7, 3.7.0 - 3.7.5

External links
http://developer.joomla.org/security-centre.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Joomla!