In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.9.x prior to 3.9.9. It is, therefore, affected by a vulnerability.

  - In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows     users authorised to create custom fields to manipulate     the filtering options and inject an unvalidated option.
    In other words, the filter attribute in subform fields     allows remote code execution. This is fixed in 3.9.9.
    (CVE-2019-14654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the detected Joomla! application is affected by a remote code execution vulnerability in versions 3.9.7 and 3.9.8 due to inadequate filtering in subform fields.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
131163	Joomla 3.9.x < 3.9.9 Joomla 3.9.9 Release (5772-joomla-3-9-9-release)	Nessus	CGI abuses	Remote	high
98631	Joomla! 3.9.7 < 3.9.9 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2019-14654

high

Tenable Plugins

high

high