An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities :

- A cross-site request forgery (CSRF) exists in versions 3.0.0 to 3.9.14 due to a missing token checks in the batch actions of various components (CVE-2020-8419)

- A cross-site request forgery (CSRF) exists in versions 3.0.0 to 3.9.14 due to a missing CSRF token check in the LESS compiler of com_templates (CVE-2020-8420)

- A cross-site scripting (XSS) vulnerability exists in versions 3.9.0 to 3.9.14 due to inadequate escaping of usernames (CVE-2020-8421)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 3.9.15. It is, therefore, affected by multiple vulnerabilities.

  - An issue was discovered in Joomla! before 3.9.15.
    Missing token checks in the batch actions of various     components cause CSRF vulnerabilities. (CVE-2020-8419)

  - An issue was discovered in Joomla! before 3.9.15. A     missing CSRF token check in the LESS compiler of     com_templates causes a CSRF vulnerability.
    (CVE-2020-8420)

  - An issue was discovered in Joomla! before 3.9.15.
    Inadequate escaping of usernames allows XSS attacks in     com_actionlogs. (CVE-2020-8421)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
98935	Joomla! 3.x < 3.9.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
133308	Joomla 3.0.x < 3.9.15 Multiple Vulnerabilities (5782-joomla-3-9-15)	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2020-8419

high

Tenable Plugins

high

high