Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Joomla! Core 3.x.x Security Bypass (3.2.0 - 3.9.4) - Vulnerability Database

Joomla! Core 3.x.x Security Bypass (3.2.0 - 3.9.4)

Description

Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently bypass ACL's. Joomla! Core versions 3.x.x ranging from 3.2.0 and up to and including 3.9.4 are vulnerable.

Remediation

Update to Joomla! Core version 3.9.5 or latest

References

https://developer.joomla.org/security-centre/778-20190402-core-helpsites-refresh-endpoint-callable-for-unauthenticated-users.html

Related Vulnerabilities

WordPress Plugin Starfish Review Generation & Marketing for WordPress Security Bypass (2.0.0) High
Common tags: Missing Update Authentication Bypass
WordPress Plugin MemberSonic Lite Security Bypass (1.2) High
Common tags: Missing Update Authentication Bypass
WordPress Plugin WP Mega Menu Security Bypass (1.4.0) High
Common tags: Missing Update Authentication Bypass
WordPress Plugin WP Mega Menu Security Bypass (1.3.9) High
Common tags: Missing Update Authentication Bypass
WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Security Bypass (1.7.14) High
Common tags: Missing Update Authentication Bypass

Severity

High

Classification

CVE-2019-10946
CWE-264
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update
Authentication Bypass