The K2 component 2.8.0 for Joomla!

Published 8 y ago 2018-02-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

none known

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 2 y ago 2024-04-24

Exploit prediction (EPSS)

2.31% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

joomlaworks.net /forum/forum-updates-other-resources/49046-false-cve-report-on-k2-v2-8-0 · x_refsource_MISC, x_transferred
exploit-db.com /exploits/44188 · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2018-7482
NVD: CVE-2018-7482

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.