ID CVE-2019-14654
Summary In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
References
Vulnerable Configurations
  • cpe:2.3:a:joomla:joomla\!:3.9.7:-:*:*:*:*:*:*
    cpe:2.3:a:joomla:joomla\!:3.9.7:-:*:*:*:*:*:*
  • cpe:2.3:a:joomla:joomla\!:3.9.7:rc:*:*:*:*:*:*
    cpe:2.3:a:joomla:joomla\!:3.9.7:rc:*:*:*:*:*:*
  • cpe:2.3:a:joomla:joomla\!:3.9.8:*:*:*:*:*:*:*
    cpe:2.3:a:joomla:joomla\!:3.9.8:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
misc https://developer.joomla.org/security-centre/787-20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html
Last major update 24-08-2020 - 17:37
Published 05-08-2019 - 01:15
Last modified 24-08-2020 - 17:37
Back to Top