CVE-2016-8870
82Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 81%
de la publicación al arma0 días
Publicada en NVD4 nov
1ª PoC27 oct
metasploit25 oct
VulnCheck28 oct
probabilidad de explotación
81%top 1% de las CVE
explotación observada
síVulnCheck
3 exploit(s) público(s)
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
Productos afectados
n/a · n/aPoCs públicas encontradas — 3
exploitdbwww.exploit-db.com/exploits/40637no verificadogithubgithub.com/cved-sources/cve-2016-8870★ 0cve_referencewww.exploit-db.com/exploits/40637/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.htmlhttps://developer.joomla.org/security-centre/659-20161001-core-account-creation.htmlhttps://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcfhttps://medium.com/%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4rhttps://www.exploit-db.com/exploits/40637/http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_priveschttp://www.securityfocus.com/bid/93876http://www.securitytracker.com/id/1037107http://www.securitytracker.com/id/1037108