What is CVE-2019-14654?

CVE-2019-14654 is a high-severity vulnerability in Joomla Joomla\!. CVSS score: 8.8/10. Published 2019-08-05.

How severe is CVE-2019-14654?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Joomla Joomla\!

CVE-2019-14654

In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

EPSS: 0.023 (81.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Joomla Joomla\! — versions 3.9.7, 3.9.8
N/a — versions n/a

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-14654?: CVE-2019-14654 is a high-severity vulnerability in Joomla Joomla\!. CVSS score: 8.8/10. Published 2019-08-05.
How severe is CVE-2019-14654?: High severity. CVSS v3 base score is 8.8 out of 10.