8.1high
CVE-2016-8870in critical feed2 exploits
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!
Published 10 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
81.1%
percentile 100%
Public exploits
2
Metasploit · Exploit-DB
Summary
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
Exploit prediction (EPSS)
81.14% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- Metasploit auxiliary/admin/http/joomla_registration_privesc Joomla Account Creation and Privilege Escalation · metasploit auxiliary, normal rank · 2016-10-25
- EDB-40637 Joomla! 3.4.4 < 3.6.4 - Account Creation / Privilege Escalation · webapps · 2016-10-27
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- securityfocus.com /bid/93876 · vdb-entry, x_refsource_BID, x_transferred
- blog.sucuri.net /2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html · x_refsource_MISC, x_transferred
- developer.joomla.org /security-centre/659-20161001-core-account-creation.html · x_refsource_CONFIRM, x_transferred
- rapid7.com /db/modules/auxiliary/admin/http/joomla_registration_privesc · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/40637/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- securitytracker.com /id/1037108 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securitytracker.com /id/1037107 · vdb-entry, x_refsource_SECTRACK, x_transferred
- github.com /joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf · x_refsource_CONFIRM, x_transferred
- medium.com /%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-8870
- NVD: CVE-2016-8870
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.