CVE-2019-14654 - In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option

Back Back to CVE browser

HIGH

In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option

Published Aug 5, 2019

8.8

HIGH

CVSS 3.0

EPSS 2.31%

Description

In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://developer.joomla.org/security-centre/787-20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://developer.joomla.org/security-centre/787-20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 5, 2019

Updated Aug 5, 2024

Reserved Aug 4, 2019

Link CVE-2019-14654

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-14654

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-14654