CVE-2019-25762

Summary

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

Affected Software

Weaknesses

• CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.exploit-db.com/exploits/46121
• http://joomboost.com/
• https://extensions.joomla.org/extensions/extension/clients-a-communities/project-a-task-management/joomproject/
• https://www.vulncheck.com/advisories/joomla-component-joomproject-information-disclosure

• ←Previous
• Next→