Vulnerability CVE-2010-1649 - CERT Civis.Net

Vulnerability Name:

CVE-2010-1649 (CCN-59029)

Assigned:

2010-05-28

Published:

2010-05-28

Updated:

2018-08-13

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-1649

Source: CCN
Type: Joomla! Security Announcements
Core - XSS Vulnerabilities in Back End

Source: CONFIRM
Type: UNKNOWN
http://developer.joomla.org/security/news/314-20100501-core-xss-vulnerabilities-in-back-end.html?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+JoomlaSecurityNews+%28Joomla!+Security+News%29

Source: CCN
Type: SA39964
Joomla search Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: Vendor Advisory
39964

Source: CCN
Type: Joomla! Web site
Joomla!

Source: OSVDB
Type: UNKNOWN
65011

Source: CCN
Type: OSVDB ID: 65011
Joomla! administrator/index.php search Parameter XSS

Source: BID
Type: UNKNOWN
40444

Source: CCN
Type: BID-40444
Joomla! Multiple Modules 'search' Parameter Cross-Site Scripting Vulnerabilities

Source: XF
Type: UNKNOWN
joomla-core-index-xss(59029)

Vulnerable Configuration:

Configuration 1:

cpe:/a:joomla:joomla!:1.5.0:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.2:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.3:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.4:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.5:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.6:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.7:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.8:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.9:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.10:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.11:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.12:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.13:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.14:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.15:-:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.16:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.17:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:joomla:joomla!:1.5.0:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.2:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.3:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.4:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.5:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.6:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.7:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.8:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.9:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.10:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.11:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.12:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.13:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.14:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.15:-:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.16:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.17:*:*:*:*:*:*:*

Denotes that component is vulnerable