Description

Joomla! Core is prone to a prototype pollution vulnerability. Exploiting this issue may allow attackers to add or modify existing properties of an "Object", when controlling part of it's structure. Joomla! Core versions 3.x.x ranging from 3.0.0 and up to and including 3.9.4 are vulnerable.

Remediation

Update to Joomla! Core version 3.9.5 or latest

References

https://developer.joomla.org/security-centre/779-20190403-core-object-prototype-pollution-in-jquery-extend.html

Related Vulnerabilities

WordPress Plugin GorillaForms-Custom Contact Forms Unspecified Vulnerability (2.0.3)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3397)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5776)

WordPress Plugin Knews Multilingual Newsletters 'ff' Parameter Cross-Site Scripting (1.1.0)

WordPress Plugin UpdraftPlus WordPress Backup Security Bypass (1.22.1)

Severity

High

Classification

CVE-2019-11358 CWE-610 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update