CVE-2011-2509: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the comcontact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the comcontent component, as demonstrated by the filterorder parameter to index.php; (3) the query string to the comnewsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the comsearch component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2509?
CVE-2011-2509 has a moderate severity rating due to the potential for cross-site scripting attacks that can compromise user data.
How do I fix CVE-2011-2509?
To fix CVE-2011-2509, upgrade to Joomla! version 1.6.4 or later, or apply the available security patches.
What components are affected by CVE-2011-2509?
CVE-2011-2509 affects the com_contact and com_content components of Joomla!.
Who can exploit CVE-2011-2509?
Remote attackers can exploit CVE-2011-2509 by injecting arbitrary web scripts or HTML via vulnerable Joomla! installations.
Is CVE-2011-2509 still a risk for current Joomla! versions?
CVE-2011-2509 is not a risk for current supported versions of Joomla! since affected versions are outdated.