Informations de sécurité Joomla!

1. [20191202] - Core - Various SQL injections through configuration parameters

   • Project: Joomla!
   • SubProject: CMS
   • Impact: High
   • Severity: Low
   • Versions: 2.5.0 - 3.9.13
   • Exploit type: SQL injection
   • Reported Date: 2019-December-01
   • Fixed Date: 2019-December-17
   • CVE Number: CVE-2019-19846

   Description

   The lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

   Affected Installs

   Joomla! CMS versions 2.5.0 - 3.9.13

   Solution

   Upgrade to version 3.9.14

   Contact

   The JSST at the Joomla! Security Centre.

   Reported By: ka1n4t

   

   

2. [20191201] - Core - Path Disclosure in framework files

   • Project: Joomla!
   • SubProject: CMS
   • Impact: Low
   • Severity: Low
   • Versions: 3.8.0 - 3.9.13
   • Exploit type: Path Disclosure
   • Reported Date: 2019-November-22
   • Fixed Date: 2019-December-17
   • CVE Number: CVE-2019-19845

   Description

   Missing access check in framework files could lead to a path disclosure.

   Affected Installs

   Joomla! CMS versions 3.8.0 - 3.9.13

   Solution

   Upgrade to version 3.9.14

   Contact

   The JSST at the Joomla! Security Centre.

   Reported By: Lee Thao, Viettel Cyber Security

   

   

3. [20191002] - Core - Path Disclosure in phpuft8 mapping files

   • Project: Joomla!
   • SubProject: CMS
   • Impact: Low
   • Severity: Low
   • Versions: 3.6.0 - 3.9.12
   • Exploit type: Path Disclosure
   • Reported Date: 2019-November-01
   • Fixed Date: 2019-November-05
   • CVE Number: CVE-2019-18674

   Description

   Missing access check in the phputf8 mapping files could lead to an path disclosure.

   Affected Installs

   Joomla! CMS versions 3.6.0 - 3.9.12

   Solution

   Upgrade to version 3.9.13

   Contact

   The JSST at the Joomla! Security Centre.

   Reported By: Phil Taylor

   

   

4. [20191001] - Core - CSRF in com_template overrides view

   • Project: Joomla!
   • SubProject: CMS
   • Impact: High
   • Severity: Low
   • Versions: 3.2.0-3.9.12
   • Exploit type: CSRF
   • Reported Date: 2019-October-10
   • Fixed Date: 2019-November-05
   • CVE Number: CVE-2019-18650

   Description

   A missing token check in com_template causes a CSRF vulnerability.

   Affected Installs

   Joomla! CMS versions 3.2.0 - 3.9.12

   Solution

   Upgrade to version 3.9.13

   Contact

   The JSST at the Joomla! Security Centre.

   Reported By:Lee Thao from Viettel Cyber Security

   

   

5. [20190901] - Core - XSS in logo parameter of default templates

   • Project: Joomla!
   • SubProject: CMS
   • Impact: Moderate
   • Severity: Low
   • Versions: 3.0.0-3.9.11
   • Exploit type: XSS
   • Reported Date: 2019-August-28
   • Fixed Date: 2019-September-24
   • CVE Number: CVE-2019-16725

   Description

   Inadequate escaping allowed XSS attacks using the logo parameter of the default templates.

   Affected Installs

   Joomla! CMS versions 3.0.0 - 3.9.11

   Solution

   Upgrade to version 3.9.12

   Contact

   The JSST at the Joomla! Security Centre.

   Reported By:Aswin M Guptha