#VU12986 Improper access control in Joomla! - CVE-2018-11323


| Updated: 2018-05-23

Vulnerability identifier: #VU12986

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-11323

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Joomla!
Web applications / CMS

Vendor: Joomla!

Description

The vulnerability allows a remote attacker to violate security restrictions.

The vulnerability exists due to improper validation of permissions within the application. A remote authenticated attacker can modify the access levels of user groups with higher permissions.

Mitigation
Update to version 3.8.8.

Vulnerable software versions

Joomla!: 2.5.0 - 2.5.28, 3.0.0 - 3.0.4, 3.1.0 - 3.1.6, 3.2.0 - 3.2.7, 3.3.0 - 3.3.6, 3.4.0 - 3.4.8, 3.5.0 - 3.5.9, 3.6.0 - 3.6.5, 3.7.0 - 3.7.5, 3.8.0 - 3.8.7

External links
https://developer.joomla.org/security-centre.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Joomla!