Description

A remote file inclusion vulnerability was reported in Joomla! core. It is possible for a remote attacker to extract a remotely hosted archive while you are extracting a backup archive or installing an update, depending on your server settings.

Affected versions: Versions: 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4.

Remediation

Upgrade to the latest version of Joomla!.

References

[20140903] - Core - Remote File Inclusion

Security update, September 2014

Related Vulnerabilities

WordPress Plugin Customer Reviews for WooCommerce Local File Inclusion (5.15.0)

WordPress Plugin Premmerce Permalink Manager for WooCommerce Local File Inclusion (2.3.10)

WordPress Plugin WP Vault Local File Inclusion (0.8.6.6)

WordPress Plugin Anti-Malware Security and Brute-Force Firewall Local File Inclusion (4.18.63)

WordPress Plugin Woocommerce-Recent Purchases Local File Inclusion (1.0.1)

Severity

High

Classification

CVE-2014-7228.xml CWE-98 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

File Inclusion