CVE-2018-6378: XSS

Q: Which Joomla! installations are affected?

Joomla! Core versions before 3.8.8 are affected. The issue is in the media manager's handling of file and folder names.

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges are required, but user interaction is required. The attack is network-reachable and has low attack complexity.

Q: What is the likely impact of a successful exploit?

Successful exploitation can lead to limited confidentiality and integrity impact through cross-site scripting. The CVSS vector indicates no direct availability impact.

Published May 22, 2018

Updated

In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.

Affected Software

1 affected component

Joomla Joomla\!<3.8.8

Event History

May 22, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which Joomla! installations are affected?

Joomla! Core versions before 3.8.8 are affected. The issue is in the media manager's handling of file and folder names.

Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges are required, but user interaction is required. The attack is network-reachable and has low attack complexity.

What is the likely impact of a successful exploit?

Successful exploitation can lead to limited confidentiality and integrity impact through cross-site scripting. The CVSS vector indicates no direct availability impact.

CVE-2018-6378: XSS

Affected Software

Event History

Frequently Asked Questions

Which Joomla! installations are affected?

Does exploitation require authentication or user interaction?

What is the likely impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which Joomla! installations are affected?

Does exploitation require authentication or user interaction?

What is the likely impact of a successful exploit?