Description

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

Remediation

References

CVE-2016-8870

Related Vulnerabilities

XOOPS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-3295)

WordPress Plugin Infusionsoft Gravity Forms Add-on Multiple Cross-Site Scripting Vulnerabilities (1.5.6)

Jenkins Incorrect Authorization Vulnerability (CVE-2018-1999004)

WordPress Plugin Flickr Gallery PHP Object Injection (1.5.2)

WebLogic CVE-2020-2967 Vulnerability (CVE-2020-2967)

Severity

High

Classification

CVE-2016-8870 CWE-20 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities