Bitnami package
joomla
pkg:bitnami/joomla
Vulnerabilities (134)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-25227 | Hig | 7.5 | >= 4.0.0, < 5.2.6 | 5.2.6 | Apr 8, 2025 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | |
| CVE-2025-25226 | Cri | 9.8 | >= 1.0.0, < 5.0.3 | 5.0.3 | Apr 8, 2025 | Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnera | |
| CVE-2024-40749 | Hig | 7.5 | >= 3.9.0, < 5.2.3 | 5.2.3 | Jan 7, 2025 | Improper Access Controls allows access to protected views. | |
| CVE-2024-40748 | Hig | 7.5 | >= 3.9.0, < 5.2.3 | 5.2.3 | Jan 7, 2025 | Lack of output escaping in the id attribute of menu lists. | |
| CVE-2024-40747 | Med | 6.1 | >= 4.0.0, < 5.2.3 | 5.2.3 | Jan 7, 2025 | Various module chromes didn't properly process inputs, leading to XSS vectors. | |
| CVE-2024-40743 | Med | 6.1 | >= 3.0.0, < 5.1.3 | 5.1.3 | Aug 20, 2024 | The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | |
| CVE-2024-27187 | Hig | 7.5 | >= 4.0.0, < 5.1.3 | 5.1.3 | Aug 20, 2024 | Improper Access Controls allows backend users to overwrite their username when disallowed. | |
| CVE-2024-27186 | Med | 6.1 | >= 4.0.0, < 5.1.3 | 5.1.3 | Aug 20, 2024 | The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | |
| CVE-2024-27185 | Cri | 9.1 | >= 3.0.0, < 5.1.3 | 5.1.3 | Aug 20, 2024 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. | |
| CVE-2024-27184 | Med | 6.1 | >= 3.4.6, < 5.1.3 | 5.1.3 | Aug 20, 2024 | Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. | |
| CVE-2024-26279 | Med | 6.1 | >= 3.0.0, < 5.1.2 | 5.1.2 | Jul 9, 2024 | The wrapper extensions do not correctly validate inputs, leading to XSS vectors. | |
| CVE-2024-26278 | Med | 6.1 | >= 3.7.0, < 5.1.2 | 5.1.2 | Jul 9, 2024 | The Custom Fields component not correctly filter inputs, leading to a XSS vector. | |
| CVE-2024-21731 | Med | 6.1 | >= 3.0.0, < 5.1.2 | 5.1.2 | Jul 9, 2024 | Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. | |
| CVE-2024-21730 | Med | 5.4 | >= 4.0.0, < 5.1.2 | 5.1.2 | Jul 9, 2024 | The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. | |
| CVE-2024-21729 | Med | 6.1 | >= 4.0.0, < 5.1.2 | 5.1.2 | Jul 9, 2024 | Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. | |
| CVE-2024-21726 | Med | 6.5 | >= 3.7.0, < 5.1.0 | 5.1.0 | Feb 29, 2024 | Inadequate content filtering leads to XSS vulnerabilities in various components. | |
| CVE-2024-21725 | Med | 6.1 | >= 4.0.0, < 5.0.3 | 5.0.3 | Feb 29, 2024 | Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components. | |
| CVE-2024-21724 | Med | 6.1 | >= 1.6.0, < 5.0.3 | 5.0.3 | Feb 29, 2024 | Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions. | |
| CVE-2024-21723 | Med | 4.3 | >= 1.5.0, < 5.0.3 | 5.0.3 | Feb 29, 2024 | Inadequate parsing of URLs could result into an open redirect. | |
| CVE-2024-21722 | Med | 6.3 | >= 3.2.0, < 5.0.3 | 5.0.3 | Feb 29, 2024 | The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified. |
- affected >= 4.0.0, < 5.2.6fixed 5.2.6
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- affected >= 1.0.0, < 5.0.3fixed 5.0.3
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnera
- affected >= 3.9.0, < 5.2.3fixed 5.2.3
Improper Access Controls allows access to protected views.
- affected >= 3.9.0, < 5.2.3fixed 5.2.3
Lack of output escaping in the id attribute of menu lists.
- affected >= 4.0.0, < 5.2.3fixed 5.2.3
Various module chromes didn't properly process inputs, leading to XSS vectors.
- affected >= 3.0.0, < 5.1.3fixed 5.1.3
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
- affected >= 4.0.0, < 5.1.3fixed 5.1.3
Improper Access Controls allows backend users to overwrite their username when disallowed.
- affected >= 4.0.0, < 5.1.3fixed 5.1.3
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
- affected >= 3.0.0, < 5.1.3fixed 5.1.3
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
- affected >= 3.4.6, < 5.1.3fixed 5.1.3
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
- affected >= 3.0.0, < 5.1.2fixed 5.1.2
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
- affected >= 3.7.0, < 5.1.2fixed 5.1.2
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
- affected >= 3.0.0, < 5.1.2fixed 5.1.2
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
- affected >= 4.0.0, < 5.1.2fixed 5.1.2
The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.
- affected >= 4.0.0, < 5.1.2fixed 5.1.2
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
- affected >= 3.7.0, < 5.1.0fixed 5.1.0
Inadequate content filtering leads to XSS vulnerabilities in various components.
- affected >= 4.0.0, < 5.0.3fixed 5.0.3
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
- affected >= 1.6.0, < 5.0.3fixed 5.0.3
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
- affected >= 1.5.0, < 5.0.3fixed 5.0.3
Inadequate parsing of URLs could result into an open redirect.
- affected >= 3.2.0, < 5.0.3fixed 5.0.3
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
Page 3 of 7