Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
Product
Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 5
-
Medium 6.1
[20240701] - Core - XSS in accessible media selection field
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
-
Medium 6.1
[20240703] - Core - XSS in StringHelper::truncate method
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
-
Medium 6.1
[20240704] - Core - XSS in Wrapper extensions
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
-
Medium 5.4
[20240702] - Core - Self-XSS in fancyselect list field layout
The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.
-
Medium 4.6
[20240705] - Core - XSS in com_fields default field value
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
Revision history
-
#1
Initiale Fassung
References
-
Joomla Security Centre 20240701 vom 2024-07-09
https://developer.joomla.org/security-centre/935-20240701-core-xss-in-accessible-media-selection-field.html
-
Joomla Security Centre 20240702 vom 2024-07-09
https://developer.joomla.org/security-centre/936-20240702-core-self-xss-in-fancyselect-list-field-layout.html
-
Joomla Security Centre 20240703 vom 2024-07-09
https://developer.joomla.org/security-centre/937-20240703-core-xss-in-stringhelper-truncate-method.html
-
Joomla Security Centre 20240704 vom 2024-07-09
https://developer.joomla.org/security-centre/938-20240704-core-xss-in-wrapper-extensions.html
-
Joomla Security Centre 20240705 vom 2024-07-09
https://developer.joomla.org/security-centre/939-20240705-core-xss-in-com-fields-default-field-value.html