Proclaim, 9.1.1, Arbitrary File Upload

2018-02-2700:00:00

velteam

vel.joomla.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.309

Percentile

97.0%

JSON

Proclaim from Christian Web Ministries (installs as com_biblestudy), versions 9.1.1 and previous, arbitrary file upload, also backup file download

resolution: update to 9.1.2 fixes both issues

update notice: <https://github.com/Joomla-Bible-Study/Joomla-Bible-Study/releases>

Affected configurations

Vulners

Node

joomlapackage_proclaimMatch9.1.1

joomlapackage_proclaimRange<9.1.2

VendorProductVersionCPE
joomlapackage_proclaim9.1.1cpe:2.3:a:joomla:package_proclaim:9.1.1:*:*:*:*:*:*:*
joomlapackage_proclaim*cpe:2.3:a:joomla:package_proclaim:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
joomla	package_proclaim	9.1.1	cpe:2.3:a:joomla:package_proclaim:9.1.1:::::::*
joomla	package_proclaim	*	cpe:2.3:a:joomla:package_proclaim::::::::