Detections
Analytics
Joomla 3.6.x < 3.9.7 Multiple Vulnerabilites
critical Nessus Plugin ID 125923
Language:
Synopsis
A PHP application running on the remote web server is affected by multiple vulnerabilities.Description
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.6.x prior to 3.9.7. It is, therefore, affected by the following vulnerabilities:- Joomla versions 3.8.13 prior to 3.9.7 are affected by a vulnerability where a non-admin user may manipulate the update server URL of the com_joomlaupdate component. An authenticated, remote attacker could exploit this to cause an update to be pulled from a malicious server (CVE-2019-12764).
- Joomla versions 3.9.x prior to 3.9.7 are affected by a CSV injection vulnerability due to insufficient validation of user-supplied input. An unauthenticated, remote attacker may exploit this by submitting special characters to the com_actionlogs component. When the resulting CSV file produced by Joomla is opened by a spreadsheet program these special characters are interpretted as a formula (CVE-2019-12765).
- Joomla versions 3.6.x prior to 3.9.6 are affected by a cross-site scripting (XSS) vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session (CVE-2019-12766).
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Joomla! version 3.9.8 or later (Note: Joomla released security fixes for the above vulnerabilites in 3.9.7. However, this release introduced an additional bug so it is recommended to upgrade your installation to 3.9.8).See Also
Plugin Details
Severity: Critical
ID: 125923
File Name: joomla_397.nasl
Version: 1.8
Type: remote
Family: CGI abuses
Published: 6/14/2019
Updated: 6/5/2024
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-12765
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:joomla:joomla%5c%21
Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/Joomla!
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/11/2019
Vulnerability Publication Date: 6/11/2019