oss-security - Re: CVE request: Joomla unspecified information disclosure vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1408065980.896976.1308858392489.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Thu, 23 Jun 2011 15:46:32 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: incidents@...rt.org, henri@...v.fi
Subject: Re: CVE request: Joomla unspecified information
 disclosure vulnerability



----- Original Message -----
> Couldn't find a CVE-identifier for this issue. Joomla does have too
> many vulnerabilities. Joomla prior to 1.5.23 contains a flaw that may
> lead to an unauthorized information disclosure. Should this one get a
> 2010 or 2011 identifier?
> 
> Reported: 2010-12-08
> Joomla advisory: 2011-04-01
> Release with a fix (version 1.5.23): 2011-04-04
> 
> References:
> http://developer.joomla.org/security/news/9-security/10-core-security/340-20110401-core-information-disclosure.html
> http://www.joomla.org/announcements/release-news/5367-joomla-1523-released.html
> http://osvdb.org/show/osvdb/71587
> http://secunia.com/advisories/44028/
> 
> I hope this request isn't duplicate. I included oCERT to this email as
> Joomla is part of that group. Please notify me and mailing-list if
> this issue already has a CVE-identifier.
> 

I'm giving this CVE-2011-2488.

While the flaw was reported in 2010 they claim, I consider 2011 when
it went public.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.