[20180505] – Core – XSS Vulnerabilities & additional hardening

Joomla is available using 1 click install in Cloud Server cPanel and Cloud Server Webuzo. Contact us to find out our latest offers!

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Versions: 3.0.0 through 3.8.7
  • Exploit type:XSS
  • Reported Date:2018-February-02 & 2018-March-27
  • Fixed Date: 2018-May-22
  • CVE Number: CVE-2018-11326

Description

Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.8.7

Solution

Upgrade to version 3.8.8

Additional Resources

Contact

The JSST at the Joomla! Security Centre.

Reported By: Kai Zhao of 3H Security Team & Zhouyuan Yang (FortiGuard Labs)
Joomla is available using 1 click install in Cloud Server cPanel and Cloud Server Webuzo. Contact us to find out our latest offers!

Comments are closed.