See other templatesSee other templates

Joomla! Security News

    • Project: Joomla!
    • SubProject: CMS
    • Impact: Low
    • Severity: Low
    • Versions: 3.7.0-3.9.18
    • Exploit type: XSS
    • Reported Date: 2020-May-08
    • Fixed Date: 2020-June-02
    • CVE Number: CVE-2020-13760

    Description

    Missing token checks in com_postinstall cause CSRF vulnerabilities.

    Affected Installs

    Joomla! CMS versions 3.7.0 - 3.9.18

    Solution

    Upgrade to version 3.9.19

    Contact

    The JSST at the Joomla! Security Centre.

    Reported By: Khoa Bùi Đức Anh
    • Project: Joomla!
    • SubProject: CMS
    • Impact: Low
    • Severity: Moderate
    • Versions: 3.0.0-3.9.18
    • Exploit type: XSS
    • Reported Date: 2020-April-10
    • Fixed Date: 2020-June-02
    • CVE Number: CVE-2020-11022 and CVE-2020-11023

    Description

    The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are "[...] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others."

    The Drupal project has backported the relevant fixes back to jQuery 1.x and Joomla has adopted that patch.

    Affected Installs

    Joomla! CMS versions 3.0.0 - 3.9.18

    Solution

    Upgrade to version 3.9.19

    Contact

    The JSST at the Joomla! Security Centre.

    Reported By:David Jardin, JSST
    • Project: Joomla!
    • SubProject: CMS
    • Impact: Moderate
    • Severity: Low
    • Versions: 3.0.0-3.9.18
    • Exploit type: XSS
    • Reported Date: 2020-May-06
    • Fixed Date: 2020-June-02
    • CVE Number: CVE-2020-13762

    Description

    Incorrect input validation of the module tag option in com_modules allow XSS attacks.

    Affected Installs

    Joomla! CMS versions 3.0.0 - 3.9.18

    Solution

    Upgrade to version 3.9.19

    Contact

    The JSST at the Joomla! Security Centre.

    Reported By: Khoa Bùi Đức Anh
    • Project: Joomla!
    • SubProject: CMS
    • Impact: Low
    • Severity: Low
    • Versions: 2.5.0-3.9.18
    • Exploit type: Insecure Permissions
    • Reported Date: 2020-April-23
    • Fixed Date: 2020-June-02
    • CVE Number: CVE-2020-13763

    Description

    The default settings of the global "textfilter" configuration doesn't block HTML inputs for 'Guest' users. With 3.9.19, the textfilter for new installations has been set to 'No HTML' for the groups 'Public', 'Guest' and 'Registered'.

    Affected Installs

    Joomla! CMS versions 2.5.0 - 3.9.18

    Solution

    Upgrade to version 3.9.19

    Contact

    The JSST at the Joomla! Security Centre.

    Reported By: Brian Teeman
    • Project: Joomla!
    • SubProject: CMS
    • Impact: Moderate
    • Severity: Low
    • Versions: 3.0.0-3.9.18
    • Exploit type: XSS
    • Reported Date: 2020-May-06
    • Fixed Date: 2020-June-02
    • CVE Number: CVE-2020-13761

    Description

    Lack of input validation in the heading tag option of the "Articles – Newsflash" and "Articles - Categories" modules allow XSS attacks.

    Affected Installs

    Joomla! CMS versions 3.0.0 - 3.9.18

    Solution

    Upgrade to version 3.9.19

    Contact

    The JSST at the Joomla! Security Centre.

    Reported By: Khoa Bùi Đức Anh
showcase
like-icon

Great Docs & Support

In addition to comprehensive documentations in PDF format, you also get support from friendly forum and dedicated support system.

Download docs

Free

Free Edition

In the case you are on tight budget or just want to taste this template before paying. We have free edition for you to download right now.

Download Free edition

Pro

FRO Edition

If you are serious about your time and money, consider to buy PRO edition to get full featured template and dedicated support service.

Buy PRO edition

Ga naar boven