CVE-2011-2892: Input Validation

Published Jul 27, 2011

Updated

Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

Affected Software

20 affected components

Joomla Joomla\!=1.6-beta15

Joomla Joomla\!=1.6-beta12

Joomla Joomla\!=1.6-beta3

Joomla Joomla\!=1.6-beta13

Joomla Joomla\!=1.6.1

Joomla Joomla\!=1.6-beta8

Joomla Joomla\!=1.6-beta5

Joomla Joomla\!=1.6.0

Joomla Joomla\!=1.6-beta1

Joomla Joomla\!=1.6-beta6

Joomla Joomla\!=1.6-beta7

Joomla Joomla\!=1.6-beta14

Joomla Joomla\!=1.6-beta11

Joomla Joomla\!=1.6-beta2

Joomla Joomla\!=1.6-alpha2

Joomla Joomla\!=1.6-alpha

Joomla Joomla\!=1.6-beta4

Joomla Joomla\!=1.6-rc1

Joomla Joomla\!=1.6-beta9

Joomla Joomla\!=1.6-beta10

Event History

Jul 27, 2011

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2892?

CVE-2011-2892 is considered a medium severity vulnerability due to its potential for exploitation in clickjacking attacks.

How do I fix CVE-2011-2892?

To fix CVE-2011-2892, upgrade your Joomla! installation to version 1.6.2 or later.

What versions of Joomla! are affected by CVE-2011-2892?

CVE-2011-2892 affects Joomla! versions 1.6.0 to 1.6.1, including various beta versions up to 1.6-beta15.

What does CVE-2011-2892 allow attackers to do?

CVE-2011-2892 allows attackers to conduct clickjacking attacks by rendering a page inside a frame on a malicious website.

Is there a workaround for CVE-2011-2892 if I cannot update Joomla!?

A potential workaround for CVE-2011-2892 is to set appropriate X-Frame-Options in server settings to mitigate clickjacking risks.