CERT-In Vulnerability Note
CIVN-2015-0309
Remote Code Execution Vulnerabilities in Joomla
Original Issue Date:December 16, 2015
Severity Rating: HIGH
Systems Affected
- Joomla! CMS versions 1.5.0 through 3.4.5
- Joomla! Framework Session package versions 1.0.0 through 1.3.0
Overview
Two vulnerabilities have been reported in Joomla! which could be exploited by remote attacker to obtain data from targeted system¿s user session to disclose sensitive information.
Description
These vulnerabilities exist in Joomla! due to the improper sanitization of browser information while saving the session details into the database.
Successful exploitation of this vulnerability could allow a remote attacker to execute code on the targeted system.
Solution
Upgrade to latest version of
Joomla! CMS 3.4.6 and
Joomla! Framework Session package version 1.3.1
https://www.joomla.org/download.html
Vendor Information
Joomla!
https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html
https://developer.joomla.org/security-centre/637-20151205-session-remote-code-execution-vulnerability.html
References
Sucuri
https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html
Joomla!
https://developer.joomla.org/security-centre/637-20151205-session-remote-code-execution-vulnerability.html
https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html
CVE Name
CVE-2015-8562
CVE-2015-8566
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|