Description

Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.0.x ranging from 1.0.0 and up to and including 1.0.12 are vulnerable.

Remediation

Update to Joomla! Core version 1.0.13 or latest

References

http://www.securityfocus.com/archive/1/archive/1/476017/100/0/threaded

https://www.joomla.org/announcements/release-news/3677-joomla-1013-released.html

Related Vulnerabilities

Artifactory Missing Authorization Vulnerability (CVE-2019-10323)

PHP-Fusion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2013-1806)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Cross-Site Scripting (1.8.9.3)

WordPress Plugin Double Opt-In for Download SQL Injection (2.0.8)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-0307)

Severity

High

Classification

CVE-2007-4188 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Session Fixation