Joomla! JRequest Initialization Bug Lets Remote Users Inject Characters into Variables
|
|
SecurityTracker Alert ID: 1020843
|
|
SecurityTracker URL: http://securitytracker.com/id?1020843
|
|
CVE Reference: CVE-2008-4105
(Links to External Site)
|
Updated: Sep 25 2008
|
Original Entry Date: Sep 10 2008
|
Impact: Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.5.x prior to 1.5.7
|
Description: A vulnerability was reported in Joomla!. A remote user can modify certain variables.
The system does not properly initialize variables set with JRequest::setVar. A remote user can inject characters into the returned data.
Andrew Eddie reported this vulnerability.
|
Impact: A remote user can modify certain variables.
|
Solution: The vendor has issued a fixed version (1.5.7).
The vendor's advisory is available at:
http://developer.joomla.org/security/news/271-20080901-core-jrequest-variable-injection.html
|
Vendor URL: www.joomla.org/announcements/release-news/5212-joomla-157-security-release-now-available.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 10 Sep 2008 00:11:45 -0400
Subject: Joomla!
|
http://developer.joomla.org/security/news/271-20080901-core-jrequest-variable-injection.html
|
|
