CVE-2016-8870 The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create u...
HighCVSS 8.1
EPSS 81.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joomla | <= 3.6.3 | No fix listed |
References
- www.rapid7.com third-party-advisory
- 93876 third-party-advisory vdb-entry
- 1037107 vdb-entry
- 1037108 third-party-advisory vdb-entry
- blog.sucuri.net
- developer.joomla.org vendor-advisory
- github.com patch
- medium.com
- 40637 exploit third-party-advisory