An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.17. It is, therefore, affected by multiple vulnerabilities :

- Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups. (CVE-2020-11889)

- Improper input validations in the usergroup table class could lead to a broken ACL configuration. (CVE-2020-11890)

- Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups. (CVE-2020-11891)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.17. It is, therefore, affected by multiple vulnerabilities.

  - An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of     com_users allow the unauthorized deletion of usergroups. (CVE-2020-11889)

  - An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class     could lead to a broken ACL configuration. (CVE-2020-11890)

  - An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of     com_users allow the unauthorized editing of usergroups. (CVE-2020-11891)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
112486	Joomla! 2.5.x < 3.9.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
135925	Joomla 2.5.x < 3.9.17 Multiple Vulnerabilities (5807-joomla-3-9-17)	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2020-11890

medium

Tenable Plugins

medium

medium