CVE-2018-11326

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Joomla! Core versions before 3.8.8 [1]. The root cause is inadequate input filtering in various fields [2]; the default filtering settings could allow users in the default Administrator user group to perform XSS attacks [1]. Affected versions include 3.1.6 through 3.8.7 [4].

Exploitation

An attacker needs to be a remote authenticated user; the default Administrator user group is specifically mentioned as a potential vector [1][2]. By supplying crafted HTML or JavaScript in user-supplied input fields that are not properly filtered before being displayed, the attacker can cause arbitrary scripting code to execute in the victim's browser [2]. The attack does not require any special network position beyond normal web access [4]. No user interaction beyond viewing the affected page is needed for the script to execute [2].

Impact

Successful exploitation allows the attacker to execute arbitrary scripting code in the security context of the affected Joomla! site [2]. This could enable the attacker to access the victim's cookies (including authentication cookies), access data recently submitted via web forms, or perform actions on the site as the victim user [2]. The impact includes information disclosure and potential privilege escalation within the application.

Mitigation

The vulnerability is fixed in Joomla! Core version 3.8.8, released on May 22, 2018 [1]. Users should upgrade to 3.8.8 or later. No workarounds are documented in the available references. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.