Description

In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

Remediation

References

CVE-2019-14654

Related Vulnerabilities

WordPress Plugin TweetScribe Cross-Site Request Forgery (1.1)

WordPress Plugin WordPress renaming tool by Vlajo Arbitrary File Download (1.0)

WordPress Plugin Redirection Cross-Site Request Forgery (1.1.3)

WordPress Plugin Mobiloud-Native Mobile Apps for your WordPress site (iPhone, iPad, Android) Multiple Cross-Site Scripting Vulnerabilities (2.3.7)

Ruby on Rails Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-5419)

Severity

High

Classification

CVE-2019-14654 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities