CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
What the vulnerability does
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
Explanation of Vulnerability in Simple Terms
JEM - Joomla Event Manager allows authenticated administrators to upload files without proper type validation. An attacker with high-level admin privileges can upload malicious files (such as PHP scripts) to the server, potentially gaining the ability to run arbitrary code. This requires administrative access to the Joomla backend.
What an attacker can do
Upload and execute malicious files on the server with admin privileges.
Potential impact on your site
A compromised admin account could lead to full site takeover through arbitrary code execution.
Conditions required to exploit
Attacker must have high-level administrator access to the Joomla backend.
Key dates
External resources
Related vulnerabilities
