Description

An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.

Remediation

References

CVE-2019-12764

Related Vulnerabilities

PHP Reliance on Cookies without Validation and Integrity Checking Vulnerability (CVE-2020-7070)

WordPress Plugin Recip.ly 'uploadImage.php' Arbitrary File Upload (1.1.7)

WordPress Plugin Video Gallery /w YouTube, Vimeo Arbitrary File Upload (8.48)

Apache Tomcat 7PK - Security Features Vulnerability (CVE-2014-9634)

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2011-3130)

Severity

Medium

Classification

CVE-2019-12764 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities