The essential news about content management systems and mobile technology.
Powered by Joocial, XT Search for Algolia, and SlimApps.

  • Project: Joomla!
  • SubProject: CMS
  • Severity: High
  • Versions: 1.5.0 through 3.4.5
  • Exploit type: Remote Code Execution
  • Reported Date: 2015-December-13
  • Fixed Date: 2015-December-14
  • CVE Numbers: requested

Description

Browser information is not filtered properly while saving the session values into the database which leads to a Remote Code Execution vulnerability.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.4.5

Solution

Upgrade to version 3.4.6

Contact

The JSST at the Joomla! Security Centre....

Reported By: Uwe Flottemensch

Read more

  • Project: Joomla! Framework
  • SubProject: Session
  • Severity: High
  • Versions: 1.0.0 through 1.3.0
  • Exploit type: Remote Code Execution
  • Reported Date: 2015-December-13
  • Fixed Date: 2015-December-14
  • CVE Number: requested

Description

Browser information is not filtered properly while saving the session values which leads to a Remote Code Execution vulnerability.

Affected Versions

Joomla! Framework Session package versions 1.0.0 through 1.3.0

Solution

Upgrade to version 1.3.1

Contact

The JSST at the Joomla! Security Centre....

Reported By: Uwe Flottemensch

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: Low
  • Versions: 3.4.0 through 3.4.5
  • Exploit type: Directory Traversal
  • Reported Date: 2015-November-26
  • Fixed Date: 2015-December-14
  • CVE Number: requested

Description

Failure to properly sanitise input data from the XML install file located within an extension's package archive allows for directory traversal.

Affected Installs

Joomla! CMS versions 3.4.0 through 3.4.5

Solution

Upgrade to version 3.4.6

Contact

The JSST at the Joomla! Security Centre....

Reported By: JSST

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: Low
  • Versions: 3.2.0 through 3.4.5
  • Exploit type: CSRF
  • Reported Date: 2015-November-26
  • Fixed Date: 2015-December-14
  • CVE Number: requested

Description

Add additional CSRF hardening in com_templates.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.4.5

Solution

Upgrade to version 3.4.6

Contact

The JSST at the Joomla! Security Centre....

Reported By: JSST

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: Low
  • Versions: 3.2.0 through 3.4.5
  • Exploit type: Directory Traversal
  • Reported Date: 2015-November-26
  • Fixed Date: 2015-December-14
  • CVE Number: requested

Description

Inadequate filtering of request data leads to a Directory Traversal vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.4.5

Solution

Upgrade to version 3.4.6

Contact

The JSST at the Joomla! Security Centre....

Reported By: JSST

Read more