Alert GCSA-20109 - Aggiornamento di sicurezza per Joomla!

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

******************************************************************

alert ID: GCSA-20109
data: 26 novembre 2020
titolo: Aggiornamento di sicurezza per Joomla!

******************************************************************

:: Descrizione del problema

E' stata rilasciata una nuova versione del CMS Joomla!
che risolve sette vulnerabilita' di sicurezza,
l'aggiornamento include anche 35 bug fixes e miglioramenti.

[20201101] - Core - com_finder ignores access levels on autosuggest
[20201102] - Core - Disclosure of secrets in Global Configuration page
[20201103] - Core - Path traversal in mod_random_image
[20201104] - Core - SQL injection in com_users list view
[20201105] - Core - User Enumeration in backend login
[20201106] - Core - CSRF in com_privacy emailexport feature
[20201107] - Core - Write ACL violation in multiple core views

Maggiori dettagli sono disponibili negli annunci ufficiali
alla sezione "Riferimenti".


:: Software interessato

Joomla! CMS versioni precedenti alla 3.9.23


:: Impatto

Provide Misleading Information (spoofing)

Cross Site Scripting (XSS)
https://cwe.mitre.org/data/definitions/79.html

Cross-site Request Forgery (CSRF)
https://cwe.mitre.org/data/definitions/352.html

Access Confidential Data
https://cwe.mitre.org/data/definitions/200.html

Unauthorised Access
https://cwe.mitre.org/data/definitions/284.html

Reduced Security


:: Soluzioni

Aggiornare Joomla!
https://downloads.joomla.org/
https://downloads.joomla.org/cms/joomla3/3-9-23
https://downloads.joomla.org/latest

Joomla! update instructions
https://docs.joomla.org/J3.x:Updating_from_an_existing_version/it


:: Riferimenti

Joomla! Release News
https://www.joomla.org/announcements/release-news/5828-joomla-3-9-23.html

Disponibile aggiornamento sicurezza Joomla!
https://www.joomla.it/notizie/rilasci-joomla/9070-disponibile-aggiornamento-sicurezza-joomla-3-9-23.html

Joomla! Security Announcements
https://developer.joomla.org/security-centre/828-20201101-core-com-finder-ignores-access-levels-on-autosuggest.html
https://developer.joomla.org/security-centre/829-20201102-core-disclosure-of-secrets-in-global-configuration-page.html
https://developer.joomla.org/security-centre/830-20201103-core-path-traversal-in-mod-random-image.html
https://developer.joomla.org/security-centre/831-20201104-core-sql-injection-in-com-users-list-view.html
https://developer.joomla.org/security-centre/832-20201105-core-user-enumeration-in-backend-login.html
https://developer.joomla.org/security-centre/833-20201106-core-csrf-in-com-privacy-emailexport-feature.html
https://developer.joomla.org/security-centre/834-20201107-core-write-acl-violation-in-multiple-core-views.html


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iD8DBQFfv9CnwZxMk2USYEIRAoT2AKCDl/0lHajSIBxqFP2QfTdEM0pgPgCfXnoV
LrNjBUIMrKNrT1xV946OWKU=
=0rZ6
-----END PGP SIGNATURE-----