CVE-2008-3228 Joomla! doesn't configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs
Joomla fails to apply security checks to SEF URLs via .htaccess, potentially allowing attackers to bypass exploit blocking mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-3228?
CVE-2008-3228 is a high-severity vulnerability in Joomla Joomla, published on 18 Jul 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unknown impact and remote attack vectors.
Weakness: CWE-16
Which versions are affected by CVE-2008-3228?
2 open source packages ship an affected version, including joomla/joomla-platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
joomla/joomla-platform Packagist | All versions | 1.5.4 |
joomla/joomla-platform Packagist | All versions | 1.5.4 |
Products include Joomla Joomla.
How do I fix CVE-2008-3228?
Upgrade joomla/joomla-platform to 1.5.4 or later.
Is CVE-2008-3228 being exploited?
There is no known exploitation of CVE-2008-3228 in the wild and no public exploit code.
Other vulnerabilities in Joomla Joomla
Sources
Also known as GHSA-mxr8-pcpg-m23j.