CVE-2015-4071

Опубликовано: 18 авг. 2017

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Средний

Описание

The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.

Ссылки

http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/102
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jul/82
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/75971
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/37666/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/102
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jul/82
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/75971
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/37666/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:helpdesk_pro_project:helpdesk_pro:*:*:*:*:*:joomla\!:*:*

Версия до 1.3.0 (включая)

EPSS

Процентиль: 94%

0.12639

Средний

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-mwmc-6chq-x9m4