CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
What the vulnerability does
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
Explanation of Vulnerability in Simple Terms
The Novarain/Tassos Framework contains an access control flaw that allows attackers to bypass authentication or authorization checks. An attacker with network access can exploit this vulnerability without requiring user interaction or special privileges. The flaw affects versions 4.10.14 through 6.0.37 and may result in unauthorized access to sensitive data or functionality.
What an attacker can do
Bypass authentication or authorization to access restricted data or functionality without valid credentials.
Potential impact on your site
Unauthorized users may access sensitive information, modify content, or perform administrative actions without permission.
Conditions required to exploit
Network access to the affected Joomla site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
