Otkrivena su dva sigurnosna propusta u radu Joomla! CMS sustava koji mogu biti iskorišteni za otkrivanje povjerljivih informacija i zaobilaženje sigurnosnih postavki. Prvi propust proizlazi zbog predvidljivog načina generiranja lozinki, što je moglo biti iskorišteno za pogađanje generirane lozinke primjerice, aktivacijom resetiranja korisničke lozinke. Drugi propust se očituje neodgovarajućom provjerom dozvola, što omogućuje neautorizirani uvid u administrativne "backend" informacije. Korisnike se upućuje na instalaciju 1.5.26 inačice sustava.

Joomla! Developer Network - Security News

///////////////////////////////////////////
[20120305] - Core - Password Change

Posted: 28 Mar 2012 12:21 AM PDT
http://feedproxy.google.com/~r/JoomlaSecurityNews/~3/Hs8kiB0ANEU/396-201...


Project: Joomla!
SubProject: All
Severity: High
Versions: 1.5.25 and all earlier 1.5.x versions
Exploit type: Password Change
Reported Date: 2012-March-8
Fixed Date: 2012-March-27

Description

Insufficient randomness leads to password reset vulnerability.
Affected Installs

Joomla! versions 1.5.25 and all earlier 1.5.x versions
Solution

Upgrade to version 1.5.26

Reported by George Argyros and Aggelos Kiayias
Contact

The JSST at the Joomla! Security Center.



///////////////////////////////////////////
[20120306] - Core - Information Disclosure

Posted: 28 Mar 2012 12:21 AM PDT
http://feedproxy.google.com/~r/JoomlaSecurityNews/~3/yEmRGoRnN-k/397-201...


Project: Joomla!
SubProject: All
Severity: Low
Versions: 1.5.25 and all earlier 1.5.x versions
Exploit type: Information Disclosure
Reported Date: 2012-January-7
Fixed Date: 2012-March-27

Description

Inadequate permission checking allows unauthorised viewing of
administrative back end information.
Affected Installs

Joomla! versions 1.5.25 and all earlier 1.5.x versions
Solution

Upgrade to version 1.5.26

Reported by Cyrille Barthelemy

Contact

The JSST at the Joomla! Security Center.



--
You are subscribed to email updates from "Joomla! Developer Network -
Security News."