Description

An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.

Remediation

References

CVE-2018-12711

Related Vulnerabilities

PHP Other Vulnerability (CVE-2015-8616)

WordPress Plugin LiveGrounds 'uid' Parameter Cross-Site Scripting (0.42)

WordPress Plugin Category Grid View Gallery TimThumb Arbitrary File Upload (0.1.1)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-19049)

XWiki Incorrect Authorization Vulnerability (CVE-2024-38369)

Severity

Medium

Classification

CVE-2018-12711 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities