FOLLOW USJoomlashack FacebookJoomlashack TwitterJoomlashack Google +Joomlashack RSS

Joomlashack logo blog
Published on 13 August 2008

Urgent Joomla 1.5 security vulnerability discovered

From the Joomla.org website:

The Joomla! community is pleased to announce the immediate availability of Joomla! 1.5.6 [Vusani]. This is a quick turnaround security release to address a high level security issue and it is recommended all users upgrade immediately.

A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user (lowest id). Typically, this is an administrator user. Note, that changing the first users username may lessen the impact of this exploit (since the person who changed the password does not know the login associated with the new password). However, the only way to completely rectify the issue is to upgrade to 1.5.6 (or patch the /components/com_user/models/reset.php file).

For more information about this exploit, click here to visit the Joomla Security Blog.

 

published in Joomla 1.5

RECENT POSTS

  • Don't know which hosting best fits your Joomla needs? Find here a post commenting about the Best Joomla Hosting 2013. http://t.co/Y42m7Vzcsv

    about 1 day ago