CVE-2018-7482

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

2.31% chance of exploitation in the next 30 days, 82th percentile

Published

2018-02-28

Updated

2024-11-14

Proof-of-concept exploits (1)

• https://exploit-db.com/exploits/44188

References

• CVE Record
• NVD entry

Related

• CVE-2018-7479
• CVE-2018-7487
• CVE-2018-7477
• CVE-2018-7489
• CVE-2018-7475
• CVE-2018-7490