Lucene search

MitreCVE-2014-7228

HistoryNov 03, 2014 - 10:55 p.m.

CVE-2014-7228

2014-11-0322:55:08

CWE-310

mitre

web.nvd.nist.gov

akeeba restore

joomla

wordpress

security vulnerability

cve-2014-7228

remote code execution

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

Low

EPSS

0.953

Percentile

99.4%

JSON

Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.

Affected configurations

Nvd

Node

joomlajoomla\!Match2.5.4

joomlajoomla\!Match2.5.5

joomlajoomla\!Match2.5.6

joomlajoomla\!Match2.5.7

joomlajoomla\!Match2.5.8

joomlajoomla\!Match2.5.9

joomlajoomla\!Match2.5.10

joomlajoomla\!Match2.5.11

joomlajoomla\!Match2.5.12

joomlajoomla\!Match2.5.13

joomlajoomla\!Match2.5.14

joomlajoomla\!Match2.5.15

joomlajoomla\!Match2.5.16

joomlajoomla\!Match2.5.17

joomlajoomla\!Match2.5.18

joomlajoomla\!Match2.5.19

joomlajoomla\!Match2.5.20

joomlajoomla\!Match2.5.21

joomlajoomla\!Match2.5.22

joomlajoomla\!Match2.5.23

joomlajoomla\!Match2.5.24

joomlajoomla\!Match2.5.25

joomlajoomla\!Match3.0.0

joomlajoomla\!Match3.0.1

joomlajoomla\!Match3.0.2

joomlajoomla\!Match3.0.3

joomlajoomla\!Match3.0.4

joomlajoomla\!Match3.1.0

joomlajoomla\!Match3.1.1

joomlajoomla\!Match3.1.2

joomlajoomla\!Match3.1.3

joomlajoomla\!Match3.1.4

joomlajoomla\!Match3.1.5

joomlajoomla\!Match3.1.6

joomlajoomla\!Match3.2.0

joomlajoomla\!Match3.2.1

joomlajoomla\!Match3.2.2

joomlajoomla\!Match3.2.3

joomlajoomla\!Match3.2.4

joomlajoomla\!Match3.2.5

joomlajoomla\!Match3.3.0

joomlajoomla\!Match3.3.1

joomlajoomla\!Match3.3.2

joomlajoomla\!Match3.3.3

joomlajoomla\!Match3.3.4

VendorProductVersionCPE
joomlajoomla\!2.5.4cpe:2.3:a:joomla:joomla\!:2.5.4:*:*:*:*:*:*:*
joomlajoomla\!2.5.5cpe:2.3:a:joomla:joomla\!:2.5.5:*:*:*:*:*:*:*
joomlajoomla\!2.5.6cpe:2.3:a:joomla:joomla\!:2.5.6:*:*:*:*:*:*:*
joomlajoomla\!2.5.7cpe:2.3:a:joomla:joomla\!:2.5.7:*:*:*:*:*:*:*
joomlajoomla\!2.5.8cpe:2.3:a:joomla:joomla\!:2.5.8:*:*:*:*:*:*:*
joomlajoomla\!2.5.9cpe:2.3:a:joomla:joomla\!:2.5.9:*:*:*:*:*:*:*
joomlajoomla\!2.5.10cpe:2.3:a:joomla:joomla\!:2.5.10:*:*:*:*:*:*:*
joomlajoomla\!2.5.11cpe:2.3:a:joomla:joomla\!:2.5.11:*:*:*:*:*:*:*
joomlajoomla\!2.5.12cpe:2.3:a:joomla:joomla\!:2.5.12:*:*:*:*:*:*:*
joomlajoomla\!2.5.13cpe:2.3:a:joomla:joomla\!:2.5.13:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
joomla	joomla\!	2.5.4	cpe:2.3:a:joomla:joomla\!:2.5.4:::::::*
joomla	joomla\!	2.5.5	cpe:2.3:a:joomla:joomla\!:2.5.5:::::::*
joomla	joomla\!	2.5.6	cpe:2.3:a:joomla:joomla\!:2.5.6:::::::*
joomla	joomla\!	2.5.7	cpe:2.3:a:joomla:joomla\!:2.5.7:::::::*
joomla	joomla\!	2.5.8	cpe:2.3:a:joomla:joomla\!:2.5.8:::::::*
joomla	joomla\!	2.5.9	cpe:2.3:a:joomla:joomla\!:2.5.9:::::::*
joomla	joomla\!	2.5.10	cpe:2.3:a:joomla:joomla\!:2.5.10:::::::*
joomla	joomla\!	2.5.11	cpe:2.3:a:joomla:joomla\!:2.5.11:::::::*
joomla	joomla\!	2.5.12	cpe:2.3:a:joomla:joomla\!:2.5.12:::::::*
joomla	joomla\!	2.5.13	cpe:2.3:a:joomla:joomla\!:2.5.13:::::::*