Main Vulnerability Database Vulnerabilities #VU27078

Input validation error in Joomla! - CVE-2020-11890

Published: April 22, 2020 / Updated: June 3, 2020

Vulnerability identifier: #VU27078

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11890

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in the usergroup table class. A remote attacker can pass specially crafted input to the application, leading to a broken ACL configuration.

Affected software

Joomla!

How to mitigate CVE-2020-11890

Install updates from vendor's website.

Joomla! - update to 3.9.17

Links to Public Exploits and PoC-codes

Exploit #2938 - CVE-2020-11890 (CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE) (June 3, 2020)

External References

https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html

Related Security Bulletins

Multiple vulnerabilities in Joomla!