In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities :

 - A flaw exists related to SQL query handling that allows disclosure of article introduction text when such articles are in the archived state. Note that only versions 3.7.0 through 3.7.5 are affected by this flaw. (CVE-2017-14595)

 - An input-validation flaw exists in the LDAP authentication plugin that allows disclosure of usernames and passwords. Note that Joomla! must be configured for LDAP authentication to be affected. (CVE-2017-14596)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.8.0. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists related to SQL query handling that allows     disclosure of article introduction text when such articles     are in the archived state. Note that only versions     3.7.0 through 3.7.5 are affected by this flaw.
    (CVE-2017-14595)

  - An input-validation flaw exists in the LDAP     authentication plugin that allows disclosure of usernames     and passwords. Note that Joomla! must be configured for     LDAP authentication to be affected. (CVE-2017-14596)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98462	Joomla! 1.5.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98461	Joomla! 1.6.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98460	Joomla! 1.7.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98459	Joomla! 2.5.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98458	Joomla! 3.0.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98457	Joomla! 3.1.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98456	Joomla! 3.2.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98455	Joomla! 3.3.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98454	Joomla! 3.4.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98453	Joomla! 3.5.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98452	Joomla! 3.6.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98451	Joomla! 3.7.x < 3.8.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
103383	Joomla! 1.5.0 < 3.8.0 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2017-14595

low

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical