The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities :

 - A security bypass vulnerability exists in the installer application due to a failure to properly check for ownership of a webspace. An unauthenticated, remote attacker can exploit this to gain control of another user's webspace. Note that this vulnerability affects versions 1.0.0 through 3.7.3. (CVE-2017-11364)

 - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. Note that this vulnerability affects versions 1.5.0 through 3.7.3. (CVE-2017-11612)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.0.0 or later but prior to 3.7.4. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in the installer     application due to a failure to properly check for     ownership of a webspace. An unauthenticated, remote     attacker can exploit this to gain control of another     user's webspace. Note that this vulnerability affects     versions 1.0.0 through 3.7.3. (CVE-2017-11364)

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of user-supplied input before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. Note that this vulnerability affects     versions 1.5.0 through 3.7.3. (CVE-2017-11612)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98450	Joomla! 1.0.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98449	Joomla! 1.5.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98448	Joomla! 1.6.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98447	Joomla! 1.7.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98446	Joomla! 2.5.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98445	Joomla! 3.0.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98444	Joomla! 3.1.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98443	Joomla! 3.2.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98442	Joomla! 3.3.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98441	Joomla! 3.4.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98440	Joomla! 3.5.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98439	Joomla! 3.6.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98438	Joomla! 3.7.x < 3.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
102017	Joomla! 1.0.0 < 3.7.4 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2017-11364

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high