~ / search / GHSA-5m3w-rvvh-8fx6

GHSA-5m3w-rvvh-8fx6

Joomla! Object Injection Vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-7743

Packages

EcosystemPackageAffectedFixed in
Packagist joomla/joomla-cms >= 2.5.0, < 3.9.3 3.9.3

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for object injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

References

External links from the advisory. They lead to third-party sites.