Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um falsche Informationen darzustellen, einen Cross-Site-Scripting-Angriff zu starten und Daten zu verändern.
Product
Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 5
-
Critical 9.1
[20240802] - Core - Cache Poisoning in Pagination
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
-
High 7.5
[20240804] - Core - Improper ACL for backend profile view
Improper Access Controls allows backend users to overwrite their username when disallowed.
-
Medium 6.1
[20240801] - Core - Inadequate validation of internal URLs
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
-
Medium 6.1
[20240803] - Core - XSS in HTML Mail Templates
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
-
Medium 6.1
[20240805] - Core - XSS vectors in Outputfilter::strip* methods
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
Revision history
-
#3
PoC für CVE-2024-27185 aufgenommen
-
#2
Korrektur CVSS Bewertung
-
#1
Initiale Fassung
References
-
Joomla Security Announcement 20240801 vom 2024-08-20
https://developer.joomla.org/security-centre/941-20240801-core-inadequate-validation-of-internal-urls.html
-
Joomla Security Announcement 20240802 vom 2024-08-20
https://developer.joomla.org/security-centre/942-20240802-core-cache-poisoning-in-pagination.html
-
Joomla Security Announcement 20240803 vom 2024-08-20
https://developer.joomla.org/security-centre/944-20240803-core-xss-in-html-mail-templates.html
-
Joomla Security Announcement 20240804 vom 2024-08-20
https://developer.joomla.org/security-centre/945-20240804-core-improper-acl-for-backend-profile-view.html
-
Joomla Security Announcement 20240805 vom 2024-08-20
https://developer.joomla.org/security-centre/946-20240805-core-xss-vectors-in-outputfilter-strip-methods.html
-
Joomla Exploits vom 2026-07-08
https://github.com/aramosf/joomla_exploits