FreeBSDBF2B9C56-B93E-11E8-B2A8-A4BADB296695joomla3 -- vulnerabilitiesw
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.01 Low
EPSS
Percentile
83.9%
JSST reports: Multiple low-priority Vulnerabilities
Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.
Inadequate output filtering on the user profile page could lead to a stored XSS attack.
Inadequate checks regarding disabled fields can lead to an ACL violation.
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882
developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html
developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html
developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.01 Low
EPSS
Percentile
83.9%