Vulnerability Description
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses include_once() instead of require(); (2) the $options variable; (3) Admin Upload Image; (4) ->load(); (5) content submissions when frontpage is selected; (6) the mosPageNav constructor; (7) saveOrder functions; (8) the absence of "exploit blocking rules" in htaccess; and (9) the ACL.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joomla | Joomla | <= 1.0.10 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/21666Vendor Advisory
- http://www.joomla.org/content/view/1841/78/Patch
- http://www.joomla.org/content/view/1843/74/
- http://www.vupen.com/english/advisories/2006/3408
- http://secunia.com/advisories/21666Vendor Advisory
- http://www.joomla.org/content/view/1841/78/Patch
- http://www.joomla.org/content/view/1843/74/
- http://www.vupen.com/english/advisories/2006/3408
FAQ
What is CVE-2006-4476?
CVE-2006-4476 is a vulnerability with a CVSS score of 7.5 (HIGH). Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses include_once() instead of require...
How severe is CVE-2006-4476?
CVE-2006-4476 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-4476?
Check the references section above for vendor advisories and patch information. Affected products include: Joomla Joomla.