Description

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.

Remediation

References

CVE-2019-10946

Related Vulnerabilities

Moodle Incorrect Authorization Vulnerability (CVE-2022-0333)

WordPress Plugin JVM WooCommerce Wishlist Unspecified Vulnerability (1.2.6)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Multiple Cross-Site Scripting Vulnerabilities (1.30)

WordPress Plugin ShopLentor-WooCommerce Builder for Elementor & Gutenberg +10 Modules-All in One Solution (formerly WooLentor) Multiple Vulnerabilities (2.5.3)

WordPress Plugin Popup Builder-Create highly converting, mobile friendly marketing popups Cross-Site Scripting (3.69.6)

Severity

High

Classification

CVE-2019-10946 CWE-306 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities