Description

An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.

Remediation

References

CVE-2018-12711

Related Vulnerabilities

WordPress Plugin Woocommerce Aliexpress Dropshipping Lite PHP Object Injection (1.0.1)

WordPress Plugin Browser and Operating System Finder Cross-Site Request Forgery (1.1)

Perl Out-of-bounds Write Vulnerability (CVE-2018-6797)

Atlassian Jira Improper Authentication Vulnerability (CVE-2021-41308)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-4662)

Severity

Medium

Classification

CVE-2018-12711 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities