An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS
    vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default
    Administrator user group to perform a XSS attack. (CVE-2018-11326)

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities :

- ACL violation in access levels affects Joomla 2.5.0 through 3.8.7

- Adding phar files to the upload blacklist affects Joomla 2.5.0 through 3.8.7

- Information Disclosure about unpublished tags affects Joomla 3.1.0 through 3.8.7

- Installer leak of plain text password to local user affects Joomla 3.0.0 through 3.8.7

- XSS Vulnerabilities & additional hardening affects Joomla 3.0.0 through 3.8.7

- Filter field in com_fields allowing remote code execution affects Joomla 3.7.0 through 3.8.7

- Session deletion race condition affects Joomla 3.0.0 through 3.8.7

- Possible XSS attack in the redirect method affects Joomla 3.1.2 through 3.8.7

- XSS vulnerability in the media manager affects Joomla 1.5.0 through 3.8.7

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.8.8. It is, therefore, affected by a multiple vulnerabilities.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
434682	SCA: security update for joomla/joomla-cms (GHSA-g3m5-vvj7-xrwv)	Tenable Cloud Security	SCA Checks	Local	medium
434682	SCA: security update for joomla/joomla-cms (GHSA-g3m5-vvj7-xrwv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
98505	Joomla! 1.5.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98504	Joomla! 1.6.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98503	Joomla! 1.7.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98502	Joomla! 2.5.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98501	Joomla! 3.0.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98500	Joomla! 3.1.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98499	Joomla! 3.2.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98498	Joomla! 3.3.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98497	Joomla! 3.4.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98496	Joomla! 3.5.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98495	Joomla! 3.6.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98494	Joomla! 3.7.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98493	Joomla! 3.8.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
110227	Joomla! < 3.8.8 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2018-11326

medium

Tenable Plugins

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical