CVE-2011-2509: XSS
First published: Wed Jul 27 2011(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Joomla | =1.6-beta15 | |
| Joomla | =1.6-beta12 | |
| Joomla | =1.6-beta3 | |
| Joomla | =1.5.11 | |
| Joomla | =1.5.13 | |
| Joomla | =1.5.3 | |
| Joomla | =1.6-beta13 | |
| Joomla | =1.5.2 | |
| Joomla | =1.5.22 | |
| Joomla | =1.5.9 | |
| Joomla | =1.5.18 | |
| Joomla | =1.6.1 | |
| Joomla | =1.6-beta8 | |
| Joomla | =1.6-beta5 | |
| Joomla | =1.5.16 | |
| Joomla | =1.5.4 | |
| Joomla | =1.6.0 | |
| Joomla | =1.5.10 | |
| Joomla | =1.6-beta1 | |
| Joomla | =1.6-beta6 | |
| Joomla | =1.5.7 | |
| Joomla | =1.5.0 | |
| Joomla | <=1.6.3 | |
| Joomla | =1.6-beta7 | |
| Joomla | =1.6-beta14 | |
| Joomla | =1.5.15 | |
| Joomla | =1.5.6 | |
| Joomla | =1.5.1 | |
| Joomla | =1.6-beta11 | |
| Joomla | =1.5.23 | |
| Joomla | =1.5.17 | |
| Joomla | =1.5.8 | |
| Joomla | =1.6-beta2 | |
| Joomla | =1.6-alpha2 | |
| Joomla | =1.5.19 | |
| Joomla | =1.6-alpha | |
| Joomla | =1.6-beta4 | |
| Joomla | =1.6-rc1 | |
| Joomla | =1.6-beta9 | |
| Joomla | =1.5.21 | |
| Joomla | =1.6-beta10 | |
| Joomla | =1.5.12 | |
| Joomla | =1.5.5 | |
| Joomla | =1.5.20 | |
| Joomla | =1.5.15-rc | |
| Joomla | =1.5.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2011/06/28/4
- http://developer.joomla.org/security/news/352-20110604-xss-vulnerability.html
- http://www.openwall.com/lists/oss-security/2011/06/29/12
- http://yehg.net/lab/pr0js/advisories/joomla/core/[joomla_1.6.3]_cross_site_scripting(XSS)
- http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.6.3%5D_cross_site_scripting%28XSS%29
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/references
- agent/description
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/joomla
- canonical/joomla
- version/joomla/1.6-beta15
- version/joomla/1.6-beta12
- version/joomla/1.6-beta3
- version/joomla/1.5.11
- version/joomla/1.5.13
- version/joomla/1.5.3
- version/joomla/1.6-beta13
- version/joomla/1.5.2
- version/joomla/1.5.22
- version/joomla/1.5.9
- version/joomla/1.5.18
- version/joomla/1.6.1
- version/joomla/1.6-beta8
- version/joomla/1.6-beta5
- version/joomla/1.5.16
- version/joomla/1.5.4
- version/joomla/1.6.0
- version/joomla/1.5.10
- version/joomla/1.6-beta1
- version/joomla/1.6-beta6
- version/joomla/1.5.7
- version/joomla/1.5.0
- version/joomla/1.6.3
- version/joomla/1.6-beta7
- version/joomla/1.6-beta14
- version/joomla/1.5.15
- version/joomla/1.5.6
- version/joomla/1.5.1
- version/joomla/1.6-beta11
- version/joomla/1.5.23
- version/joomla/1.5.17
- version/joomla/1.5.8
- version/joomla/1.6-beta2
- version/joomla/1.6-alpha2
- version/joomla/1.5.19
- version/joomla/1.6-alpha
- version/joomla/1.6-beta4
- version/joomla/1.6-rc1
- version/joomla/1.6-beta9
- version/joomla/1.5.21
- version/joomla/1.6-beta10
- version/joomla/1.5.12
- version/joomla/1.5.5
- version/joomla/1.5.20
- version/joomla/1.5.15-rc
- version/joomla/1.5.14