vendor:
Joomla
by:
XiphosResearch
8,8
CVSS
HIGH
Joomla com_users:user.register Whitelisting Bypass
434
CWE
Product Name: Joomla
Affected Version From: Joomla 3.9.0
Affected Version To: Joomla 3.9.19
Patch Exists: YES
Related CWE: CVE-2020-14750
CPE: a:joomla:joomla
Other Scripts:
N/A
Tags: packetstorm,cve,cve2020,rce,oracle,weblogic,unauth,kev
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Nuclei References:
https://github.com/pprietosanchez/CVE-2020-14750, https://www.oracle.com/security-alerts/alert-cve-2020-14750.html, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14750, https://nvd.nist.gov/vuln/detail/CVE-2020-14750, http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
Nuclei Metadata: {'max-request': 1, 'shodan-query': 'http.html:"Weblogic Application Server"', 'verified': True, 'vendor': 'oracle', 'product': 'fusion_middleware'}
Platforms Tested: Linux, Mac, Windows
2020
Joomla com_users:user.register Whitelisting Bypass
Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See also CVE-2020-14882, which is addressed in the October 2020 Critical Patch Update.
Mitigation:
To mitigate this vulnerability, administrators should ensure that the whitelisting of the Joomla com_users:user.register component is properly configured to block the upload of malicious files with the .pht extension.
