CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
Explanation of Vulnerability in Simple Terms
The miniOrange Oauth Client extension for Joomla contains an access control flaw that allows unauthenticated attackers to modify or delete data on the site. The vulnerability affects versions 1.0.0 through 3.2.0. No authentication or user interaction is required to exploit this issue. Site administrators should update to a patched version as soon as it becomes available.
What an attacker can do
Modify or delete site data without logging in.
Potential impact on your site
Attackers can alter or remove critical site content and configuration without any credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
