In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.6.x prior to 3.9.11. It is, therefore, affected by a vulnerability in com_contact due to improper access control checks. A remote attacker can exploit this to submit mail in disabled forms.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the detected Joomla! application is affected by an incorrect access control vulnerability in versions 1.6.2 to 3.9.10 due to inadequate checks in com_contact.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
128077	Joomla! 1.6.x < 3.9.11 Joomla 3.9.11 Release (5775-joomla-3-9-11)	Nessus	CGI abuses	Remote	medium
98666	Joomla! 1.6.2 < 3.9.11 Incorrect Access Control	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2019-15028

medium

Tenable Plugins

medium

medium