CVE-2017-14596: Critical severity joomla vulnerability
Published Sep 20, 2017
·Updated
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
Affected Software
119 affected components
Joomla Joomla\!=1.5.0
Joomla Joomla\!=1.5.1
Joomla Joomla\!=1.5.2
Joomla Joomla\!=1.5.3
Joomla Joomla\!=1.5.4
Joomla Joomla\!=1.5.5
Joomla Joomla\!=1.5.6
Joomla Joomla\!=1.5.7
Joomla Joomla\!=1.5.8
Joomla Joomla\!=1.5.9
Joomla Joomla\!=1.5.10
Joomla Joomla\!=1.5.11
Joomla Joomla\!=1.5.12
Joomla Joomla\!=1.5.13
Joomla Joomla\!=1.5.14
Joomla Joomla\!=1.5.15
Joomla Joomla\!=1.5.16
Joomla Joomla\!=1.5.17
Joomla Joomla\!=1.5.18
Joomla Joomla\!=1.5.19
Joomla Joomla\!=1.5.20
Joomla Joomla\!=1.5.21
Joomla Joomla\!=1.5.22
Joomla Joomla\!=1.5.23
Joomla Joomla\!=1.5.24
Joomla Joomla\!=1.5.25
Joomla Joomla\!=1.5.26
Joomla Joomla\!=1.6.0
Joomla Joomla\!=1.6.1
Joomla Joomla\!=1.6.2
Joomla Joomla\!=1.6.3
Joomla Joomla\!=1.6.4
Joomla Joomla\!=1.6.5
Joomla Joomla\!=1.6.6
Joomla Joomla\!=1.7.0
Joomla Joomla\!=1.7.1
Joomla Joomla\!=1.7.2
Joomla Joomla\!=1.7.3
Joomla Joomla\!=1.7.4
Joomla Joomla\!=1.7.5
Joomla Joomla\!=2.5.0
Joomla Joomla\!=2.5.1
Joomla Joomla\!=2.5.2
Joomla Joomla\!=2.5.3
Joomla Joomla\!=2.5.4
Joomla Joomla\!=2.5.5
Joomla Joomla\!=2.5.6
Joomla Joomla\!=2.5.7
Joomla Joomla\!=2.5.8
Joomla Joomla\!=2.5.9
Joomla Joomla\!=2.5.10
Joomla Joomla\!=2.5.11
Joomla Joomla\!=2.5.12
Joomla Joomla\!=2.5.13
Joomla Joomla\!=2.5.14
Joomla Joomla\!=2.5.15
Joomla Joomla\!=2.5.16
Joomla Joomla\!=2.5.17
Joomla Joomla\!=2.5.18
Joomla Joomla\!=2.5.19
Joomla Joomla\!=2.5.20
Joomla Joomla\!=2.5.21
Joomla Joomla\!=2.5.22
Joomla Joomla\!=2.5.23
Joomla Joomla\!=2.5.24
Joomla Joomla\!=2.5.25
Joomla Joomla\!=2.5.26
Joomla Joomla\!=2.5.27
Joomla Joomla\!=2.5.28
Joomla Joomla\!=3.0.0
Joomla Joomla\!=3.0.1
Joomla Joomla\!=3.0.2
Joomla Joomla\!=3.0.3
Joomla Joomla\!=3.0.4
Joomla Joomla\!=3.1.0
Joomla Joomla\!=3.1.1
Joomla Joomla\!=3.1.2
Joomla Joomla\!=3.1.3
Joomla Joomla\!=3.1.4
Joomla Joomla\!=3.1.5
Joomla Joomla\!=3.1.6
Joomla Joomla\!=3.2.0
Joomla Joomla\!=3.2.1
Joomla Joomla\!=3.2.2
Joomla Joomla\!=3.2.3
Joomla Joomla\!=3.2.4
Joomla Joomla\!=3.2.5
Joomla Joomla\!=3.2.6
Joomla Joomla\!=3.2.7
Joomla Joomla\!=3.3.0
Joomla Joomla\!=3.3.1
Joomla Joomla\!=3.3.2
Joomla Joomla\!=3.3.3
Joomla Joomla\!=3.3.4
Joomla Joomla\!=3.3.5
Joomla Joomla\!=3.3.6
Joomla Joomla\!=3.4.0
Joomla Joomla\!=3.4.1
Joomla Joomla\!=3.4.2
Joomla Joomla\!=3.4.3
Joomla Joomla\!=3.4.4
Joomla Joomla\!=3.4.5
Joomla Joomla\!=3.4.6
Joomla Joomla\!=3.4.7
Joomla Joomla\!=3.4.8
Joomla Joomla\!=3.5.0
Joomla Joomla\!=3.5.1
Joomla Joomla\!=3.6.0
Joomla Joomla\!=3.6.1
Joomla Joomla\!=3.6.2
Joomla Joomla\!=3.6.3
Joomla Joomla\!=3.6.4
Joomla Joomla\!=3.6.5
Joomla Joomla\!=3.7.0
Joomla Joomla\!=3.7.1
Joomla Joomla\!=3.7.2
Joomla Joomla\!=3.7.3
Joomla Joomla\!=3.7.4
Joomla Joomla\!=3.7.5
Event History
Sep 20, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14596?
The severity of CVE-2017-14596 is classified as medium due to potential exposure of sensitive information.
2
How do I fix CVE-2017-14596?
To fix CVE-2017-14596, update your Joomla! installation to version 3.8.0 or later where the issue has been addressed.
3
Which versions of Joomla! are affected by CVE-2017-14596?
CVE-2017-14596 affects Joomla! versions prior to 3.8.0, including all 1.5.x and 2.5.x versions.
4
What impact does CVE-2017-14596 have on LDAP authentication in Joomla?
CVE-2017-14596 can lead to unauthorized disclosure of user credentials during LDAP authentication due to inadequate escaping.
5
Is there a workaround for CVE-2017-14596 before upgrading Joomla?
A temporary workaround is to disable LDAP authentication until the Joomla! installation can be upgraded to a secure version.