Description

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.

Remediation

References

CVE-2019-10946

Related Vulnerabilities

Joomla! Core 2.5.x Arbitrary File Upload (2.5.0 - 2.5.13)

PHP Improper Input Validation Vulnerability (CVE-2016-4071)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-3997)

Drupal Core 6.x Security Bypass (6.0 - 6.29)

Joomla! Core 2.5.x Cross-Site Scripting (2.5.0 - 2.5.3)

Severity

High

Classification

CVE-2019-10946 CWE-306 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities