CVE-2018-17856 Joomla RCE Vulnerability
HighCVSS 7.2
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joomla/framework(Packagist) | >= 2.5.4, < 3.8.13 | 3.8.13 |
| joomla/framework(Packagist) | >= 2.5.4, <= 3.8.12 | No fix listed |
| joomla | >= 2.5.4, < 3.8.13 | 3.8.13 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- developer.joomla.org vendor-advisory
- github.com product
- web.archive.org
- web.archive.org
- github.com
- 105559 third-party-advisory vdb-entry
- 1041914 third-party-advisory vdb-entry