CVSS base score
What the vulnerability does
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.
Explanation of Vulnerability in Simple Terms
Insufficient metadata is available to generate a reliable CVE summary. The CVSS score, vector, and CWE classification are all marked unknown, and the affected version range appears malformed (>= 1.0-2.26 and < 1.0-2.26 is empty). A patched version is not documented. Contact the K2 extension vendor or Joomla security resources for clarification before taking action.
What an attacker can do
Unable to determine without CVSS vector and CWE data.
Potential impact on your site
Unable to assess impact without complete vulnerability classification.
Conditions required to exploit
Unable to determine without CVSS vector data.
Key dates
External resources
Related vulnerabilities
