CVE-2009-1279: XSS
First published: Thu Apr 09 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) com_admin component, (2) com_search component when "Gather Search Statistics" is enabled, and (3) the category view in the com_content component.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Joomla | =1.5.5 | |
| Joomla | =1.5 | |
| Joomla | =1.5.7 | |
| Joomla | =1.5.0-beta2 | |
| Joomla | =1.5.9 | |
| Joomla | =1.5.3 | |
| Joomla | =1.5.2 | |
| Joomla | =1.5.0-beta1 | |
| Joomla | =1.5.8 | |
| Joomla | =1.5.1 | |
| Joomla | =1.5.4 | |
| Joomla | =1.5.0-rc1 | |
| Joomla | =1.5.6 | |
| Joomla | =1.5.0-beta |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/34551
- http://www.securityfocus.com/bid/34360
- http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html
- http://developer.joomla.org/security/news/294-20090302-core-comcontent-xss.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49655
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49654
Frequently Asked Questions
What vulnerability does CVE-2009-1279 describe?
CVE-2009-1279 describes multiple cross-site scripting (XSS) vulnerabilities in Joomla! versions 1.5 through 1.5.9.
What components of Joomla! are affected by CVE-2009-1279?
The affected components include com_admin, com_search with 'Gather Search Statistics' enabled, and the category view.
What are the risks associated with CVE-2009-1279?
The risks involve remote attackers being able to inject arbitrary web script or HTML, leading to potential theft of sensitive information.
How can I mitigate the risks from CVE-2009-1279?
Mitigation can be achieved by upgrading Joomla! to a version beyond 1.5.9 where the vulnerabilities are patched.
Is my Joomla! site vulnerable if it runs version 1.5.x?
Yes, any Joomla! site running version 1.5.x is vulnerable and should be updated immediately to prevent exploitation.
- agent/type
- agent/softwarecombine
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/joomla
- canonical/joomla
- version/joomla/1.5.5
- version/joomla/1.5
- version/joomla/1.5.7
- version/joomla/1.5.0-beta2
- version/joomla/1.5.9
- version/joomla/1.5.3
- version/joomla/1.5.2
- version/joomla/1.5.0-beta1
- version/joomla/1.5.8
- version/joomla/1.5.1
- version/joomla/1.5.4
- version/joomla/1.5.0-rc1
- version/joomla/1.5.6
- version/joomla/1.5.0-beta