CVE-2019-7743

CRITICAL

Joomla! 2.5.0-3.9.2 - Deserialization of Untrusted Data via phar:// Stream Wrapper

Title source: llm
STIX 2.1

Description

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/107050

Scores

CVSS v3 9.8
EPSS 0.0267
EPSS Percentile 83.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502 CWE-917
Status published
Products (2)
joomla/joomla-cms 2.5.0 - 3.9.3Packagist
joomla/joomla\! 2.5.0 - 3.9.2
Published Feb 12, 2019
Tracked Since Feb 18, 2026