Joomla! Developer - Vulnerability News

[20090606] - Core - Missing JEXEC Check

dextercowley@gmail.com (Mark Dexter) — Wed, 01 Jul 2009 04:46:19 +0000

Project: Joomla!
SubProject: Admin client
Severity: Moderate
Versions: 1.5.11 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-June-22
Fixed Date: 2009-June-30

Description

Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.

Solution

Upgrade to latest Joomla! version (1.5.12 or newer).

Contact

The JSST at the Joomla! Security Center.

[20090605] - Core - Frontend XSS - PHP_SELF not properly filtered

dextercowley@gmail.com (Mark Dexter) — Wed, 01 Jul 2009 04:46:06 +0000

Project: Joomla!
SubProject: Site client
Severity: Moderate
Versions: 1.5.11 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-June-03
Fixed Date: 2009-June-30

Description

An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.

Solution

Upgrade to latest Joomla! version (1.5.12 or newer).

Reported By Paul Boekholt (Byte Internet)

Contact

The JSST at the Joomla! Security Center.

[20090604] - Core - Frontend XSS - HTTP_REFERER not properly filtered

dextercowley@gmail.com (Mark Dexter) — Wed, 01 Jul 2009 04:45:53 +0000

Project: Joomla!
SubProject: Site client
Severity: Moderate
Versions: 1.5.11 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-June-30
Fixed Date: 2009-June-30

Description

An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTP_REFERER variable is not properly parsed.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.

Solution

Upgrade to latest Joomla! version (1.5.12 or newer).

Reported by Juan Galiana Lara (Internet Security Auditors)

Contact

The JSST at the Joomla! Security Center.

[20090603] - Core - Frontend XSS

ian.maclennan@help.joomla.org (Ian MacLennan) — Wed, 03 Jun 2009 05:56:53 +0000

Project: Joomla!
SubProject: Site client
Severity: Low
Versions: 1.5.10 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-May-05
Fixed Date: 2009-June-02

Description

Some values were output from the database without being properly escaped. Most strings in question were sourced from the administrator panel.

Affected Installs

All 1.5.x installs prior to and including 1.5.10 are affected.

Solution

Upgrade to latest Joomla! version (1.5.11 or newer).

Contact

The JSST at the Joomla! Security Center.

[20090602] - Core - ja_purity XSS

ian.maclennan@help.joomla.org (Ian MacLennan) — Wed, 03 Jun 2009 05:56:42 +0000

Project: Joomla!
SubProject: ja_purity
Severity: Moderate
Versions: 1.5.10 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-April-06
Fixed Date: 2009-June-02

Description

A XSS vulnerability exists in the JA_Purity template which ships with Joomla! 1.5.

Affected Installs

All 1.5.x installs prior to and including 1.5.10 are affected.

Solution

Upgrade to latest Joomla! version (1.5.11 or newer).

Reported by Juan Galiana Lara.

Contact

The JSST at the Joomla! Security Center.

[20090601] - Core - com_users XSS

ian.maclennan@help.joomla.org (Ian MacLennan) — Wed, 03 Jun 2009 05:56:25 +0000

Project: Joomla!
SubProject: com_users
Severity: Moderate
Versions: 1.5.10 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-April-30
Fixed Date: 2009-June-02

Description

A XSS vulnerability exists in the user view of com_users in the administrator panel.

Affected Installs

All 1.5.x installs prior to and including 1.5.10 are affected.

Solution

Upgrade to latest Joomla! version (1.5.11 or newer).

Reported by Airton Torres.

Contact

The JSST at the Joomla! Security Center.

[20090302] - Core - com_content XSS

anthony.ferrara@joomla.org (Anthony Ferrara) — Wed, 25 Mar 2009 17:08:07 +0000

Project: Joomla!
SubProject: com_content
Severity: Low
Versions: 1.5.9 and all previous 1.5 releases
Exploit type: XSS
Reported Date: 2009-March-12
Fixed Date: 2009-March-27

Description

A XSS vulnerability exists in the category view of com_content.

Affected Installs

All 1.5.x installs prior to and including 1.5.9 are affected.

Solution

Upgrade to latest Joomla! version (1.5.10 or newer).

Contact

The JSST at the Joomla! Security Center.

[20090301] - Core - Multiple XSS/CSRF

anthony.ferrara@joomla.org (Anthony Ferrara) — Wed, 25 Mar 2009 17:02:52 +0000

Project: Joomla!
SubProject: Multiple
Severity: Moderate
Versions: 1.5.9 and all previous 1.5 releases
Exploit type: XSS and CSRV
Reported Date: 2009-February-15
Fixed Date: 2009-March-27

Description

A series of XSS and CSRF faults exist in the administrator application. Affected administrator components include com_admin, com_media, com_search. Both com_admin and com_search contain XSS vulnerabilities, and com_media contains 2 CSRF vulnerabilities.

Affected Installs

All 1.5.x installs prior to and including 1.5.9 are affected. The com_search XSS vulnerability requires that "Gather Search Statistics" be enabled to be exploitable (Disabled by default).

Solution

Upgrade to latest Joomla! version (1.5.10 or newer).

Contact

The JSST at the Joomla! Security Center.

[20090102] - Core - plg_xstandard Directory Traversal

anthony.ferrara@joomla.org (Anthony Ferrara) — Fri, 09 Jan 2009 16:22:21 +0000

Project: Joomla!
SubProject: plg_xstandard
Severity: High
Versions: 1.5.8 and all previous 1.5 releases
Exploit type: Directory Traversal
Reported Date: 2009-January-7
Fixed Date: 2009-January-9

Description

A crafted request can cause disclosure of the directory structure on the server (including any directory that php has access to).

Affected Installs

All 1.5.x installs prior to and including 1.5.8 are affected.

Solution

Upgrade to latest Joomla! version (1.5.9 or newer).

Contact

The JSST at the Joomla! Security Center.

[20090101] - Core - JSession SSL Session Disclosure

anthony.ferrara@joomla.org (Anthony Ferrara) — Fri, 09 Jan 2009 16:12:16 +0000

Project: Joomla!
SubProject: framework
Severity: Low
Versions: 1.5.8 and all previous 1.5 releases
Exploit type: Session Hijacking/
Reported Date: 2008-November-20
Fixed Date: 2009-January-9

Description

When running a site under SSL ONLY (the entire site is forced to be under ssl), Joomla! does not set the SSL flag on the cookie. This can allow someone monitoring the network to find the cookie related to the session. Please note that all data is still transferred securely.

Affected Installs

1.5.8 and lower installs which are run with SSL only (no non-ssl access).

Solution

Upgrade to latest Joomla! version (1.5.9 or newer), and set force_ssl in global configuration. Alternatively, the php setting session.secure_cookie can be set in .htaccess or php.ini. Joomla! (all versions) will respect this setting.

Reported By Hanno Boeck

Contact

The JSST at the Joomla! Security Center.