CVE-2017-16634

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101701Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039757Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/713-20171102-core-2-factor-authentication-bypassPatch, Vendor Advisory
http://www.securityfocus.com/bid/101701Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039757Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/713-20171102-core-2-factor-authentication-bypassPatch, Vendor Advisory

Timeline

Published: Nov 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166355.4In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote CVE-2017-166365.4In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Rem CVE-2017-166374.4In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN co CVE-2017-166389.8The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard lin CVE-2017-166394.3Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a diffe CVE-2017-16645.9IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp CVE-2017-166417.2lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an CVE-2017-166427.5In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' a CVE-2017-166436.6The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a den CVE-2017-166446.6The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of CVE-2017-166456.6The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a de CVE-2017-166466.6drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and sys