Description
In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
Remediation
References
Related Vulnerabilities
Serendipity Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-8101)
MySQL CVE-2018-2805 Vulnerability (CVE-2018-2805)
XWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2023-34466)
Frontaccounting Other Vulnerability (CVE-2007-4279)
WordPress Plugin Content Staging Cross-Site Scripting (2.0.1)