CVEvulnerability
CVE-2019-10945
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-04-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.
Affected configurations
• joomla joomla\! (>= 1.5.0 <= 3.9.4)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://packetstormsecurity.com/files/152515/Joomla-3.9.4-Arbitrary-File-Deletion-Directory-Traversal.html Exploit, Third Party Advisory, VDB Entry
- https://developer.joomla.org/security-centre/777-20190401-core-directory-traversal-in-com-media Vendor Advisory
- https://www.exploit-db.com/exploits/46710/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/152515/Joomla-3.9.4-Arbitrary-File-Deletion-Directory-Traversal.html Exploit, Third Party Advisory, VDB Entry
- https://developer.joomla.org/security-centre/777-20190401-core-directory-traversal-in-com-media Vendor Advisory
- https://www.exploit-db.com/exploits/46710/ Exploit, Third Party Advisory, VDB Entry