CVE-2019-7743

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502 CWE-917

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/107050Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/770-20190206-core-implement-the-typo3-phar-stream-wrapperVendor Advisory
http://www.securityfocus.com/bid/107050Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/770-20190206-core-implement-the-typo3-phar-stream-wrapperVendor Advisory

Timeline

Published: Feb 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-77446.1An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerab CVE-2019-77459.8JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap_web_cgi Page=GetW CVE-2019-77468.1JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser re CVE-2019-77479.6DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.CVE-2019-77486.1_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.CVE-2019-77517.5A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing,CVE-2019-77536.1Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.CVE-2019-77558.8In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the CVE-2019-77586.5Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 CVE-2019-77598.8Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear CVE-2019-77608.8Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear CVE-2019-77618.8Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear