7.5high
CVE-2008-3228
Joomla! doesn't configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs
Also known as GHSA-mxr8-pcpg-m23j
Published 18 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 67%
Public exploits
0
none known
Summary
Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unknown impact and remote attack vectors.
Exploit prediction (EPSS)
1.16% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | joomla/joomla-platform | <1.5.4 | 1.5.4 |
Classification
- Weakness
- CWE-16 Configuration
References
- openwall.com /lists/oss-security/2008/07/12/2 · mailing-list, x_refsource_MLIST, x_transferred
- joomla.org /content/view/5180/1/ · x_refsource_CONFIRM, x_transferred
- joomla.org /content/view/5180/1/1/1/#htaccess · x_refsource_CONFIRM, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/44206 · vdb-entry, x_refsource_XF, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2008-3228 · advisory
- github.com /joomla/joomla-platform · package
- web.archive.org /web/20080730154423/http://www.joomla.org/content/view/5180/1 · web
Sources
- CVE List: CVE-2008-3228
- GitHub Advisory: GHSA-mxr8-pcpg-m23j
- NVD: CVE-2008-3228
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.