CVE-2014-7984
HighSummary
Joomla! CMS versions 2.5.x before 2.5.19 and 3.x before 3.2.3 allow remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
Risk Assessment
Attackers may gain access to the system by bypassing security measures, potentially leading to unauthorized access to data and system functions.
Recommendation
It is recommended to update Joomla! to the latest version to mitigate this vulnerability and implement additional security measures to protect against unauthorized access.
Other vulnerabilities in Joomla! CMS
See all- CVE-2017-11364High
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.
- CVE-2017-9933High
Improper cache invalidation in Joomla! CMS from version 1.7.3 through 3.7.2 leads to disclosure of form contents.
- CVE-2014-7981High
SQL injection vulnerability in Joomla! CMS versions 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-9836Critical
The file scanning mechanism JFilterInput::isFileSafe() in Joomla! CMS before version 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, allowing users to upload and execute files with .php6, .php7, .phtml, and .phpt extensions. Additionally, JHelperMedia::canUpload() did not blacklist these file extensions as uploadable file types.
Original NVD description (English source)
Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.