An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code.
    The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and
    trigger code execution. (CVE-2018-17856)

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities :

 - Mail submission in disabled forms due to inadequate checks in com_contact affects Joomla 2.5.0 through 3.8.12

 - Inadequate default access level for com_joomlaupdate affects Joomla 2.5.4 through 3.8.12

 - Access level violation due to inadequate checks on the tags search fields affects Joomla 3.1.0 through 3.8.12

 - ACL violation in com_users for admin verification affects Joomla 1.5.0 through 3.8.12

 - CSRF in com_installer actions in the backend affects Joomla 2.5.0 through 3.8.12

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.8.13. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
432251	SCA: security update for joomla/framework (GHSA-9m72-pw47-292w)	Tenable Cloud Security	SCA Checks	high
432251	SCA: security update for joomla/framework (GHSA-9m72-pw47-292w)	Tenable Self-Hosted Container Security	SCA Checks	high
98519	Joomla! 1.5.x < 3.8.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
118069	Joomla! < 3.8.13 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-17856

high

Tenable Plugins

high

high

high

high