CVE-2017-11364

Severity CVSS v4.0:
Pending analysis
Type:
CWE-295 Improper Certificate Validation
Publication date:
02/08/2017
Last modified:
20/04/2025

Description

The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:joomla:joomla\!:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.8:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.9:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.10:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.11:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.12:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.13:*:*:*:*:*:*:*
cpe:2.3:a:joomla:joomla\!:1.0.14:*:*:*:*:*:*:*