According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.10.7 or 4.0.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities.

  - An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy     crafted tar package could write files outside of the intended path. (CVE-2022-23793)

  - An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an     excess length causes the error. This error brings up the screen with the path of the source code of the     web application. (CVE-2022-23794)

  - An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to     a specific authentication mechanism which could under very special circumstances allow an account     takeover. (CVE-2022-23795)

  - An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS     attack using com_fields. (CVE-2022-23796)

  - An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the     selected Ids on an request could resulted into an possible SQL injection. (CVE-2022-23797)

  - An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of     URLs could result into an invalid check whether an redirect URL is internal or not. (CVE-2022-23798)

  - An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes     method-specific input bags with $_REQUEST data. (CVE-2022-23799)

  - An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS     vulnerabilities in various components. (CVE-2022-23800)

  - An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in     com_media. (CVE-2022-23801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Joomla 2.5.x < 3.10.7 / 4.0.x < 4.1.1 Multiple Vulnerabilities (5857-joomla-4-1-1-and-3-10-7-release)

critical Nessus Plugin ID 159348

Version 1.10

Version 1.9

Version 1.8

Version 1.10 Jun 5, 2024, 1:32 PM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202406051332
Version 1.9 Feb 3, 2023, 2:05 PM IAVM reference Plugin Feed: 202302031405
Version 1.8 Nov 17, 2022, 9:58 PM IAVM reference Plugin Feed: 202211172158