GHSA-5m3w-rvvh-8fx6CriticalCVSS 9.8

Joomla! Object Injection Vulnerability

Published
May 13, 2022
Last Modified
September 28, 2023

🔗 CVE IDs covered (1)

CVE-2019-7743 →

📋 Description

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for object injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

🎯 Affected products1

  • composer/joomla/joomla-cms:>= 2.5.0, < 3.9.3

🔗 References (5)