CVE-2018-7482: Path Traversal
DISPUTED The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
K2 component for Joomla!to a version that resolves this vulnerability.Fixed in 2.8.1 - Configuration
Upgrade to K2 2.8.1 to add additional blocking of .php downloads in the media-manager path (e.g., requests that attempt to download configuration.php via directory traversal should be blocked).
K2 component for Joomla! (media-manager connector) block .php downloads = .php - Configuration
Ensure the pathname pattern like "../configuration.php" is base64 encoded for a valid attack path (as indicated by the issue statement) so that directory traversal payloads do not work.
K2 component for Joomla! (handling of target path traversal) target pathname encoding = base64
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7482?
The severity of CVE-2018-7482 is classified as critical due to its potential for unauthorized file access.
How do I fix CVE-2018-7482?
To fix CVE-2018-7482, upgrade K2 to a version that addresses this vulnerability and ensure that directory traversal protections are implemented.
What vulnerabilities are associated with CVE-2018-7482?
CVE-2018-7482 is associated with incorrect access control that allows directory traversal attacks.
What versions of K2 are affected by CVE-2018-7482?
CVE-2018-7482 affects K2 version 2.8.0 for Joomla!.
How can attackers exploit CVE-2018-7482?
Attackers can exploit CVE-2018-7482 by crafting requests that manipulate file paths to download sensitive files.