373 lines
15 KiB
JSON
373 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-63265",
|
|
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Joomla",
|
|
"dateReserved": "2026-07-16T05:24:31.924Z",
|
|
"datePublished": "2026-07-22T20:44:05.164Z",
|
|
"dateUpdated": "2026-07-28T05:35:26.645Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"affected": [
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Advanced Module Manager extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-11.0.1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Articles Anywhere extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-18.0.2"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Articles Field extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-4.7.1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Better Frontend Link extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-2.2.5"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Cache Cleaner extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-9.7.6"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "CDN for Joomla extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-7.3.7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Conditional Content extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-6.0.0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Content Templater extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-13.0.0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "DB Replacer extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-8.2.7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Email Protector extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-6.3.7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Regular Labs Extension Manager extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-9.2.5"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "GeoIP extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-6.3.8"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "IP Login extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-6.2.5"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Keyboard Shortcuts extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-3.2.5"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Modals extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-15.0.0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Modules Anywhere extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-8.4.1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Quick Index extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-4.3.6"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "ReReplacer extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-15.0.3"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Snippets extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-9.3.10"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Sourcerer extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-12.2.8"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Tooltips extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-9.4.7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "Users Anywhere extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-1.2.7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"defaultStatus": "unaffected",
|
|
"product": "What? Nothing! extension for Joomla",
|
|
"vendor": "regularlabs.com",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "1.0.0-17.2.5"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization."
|
|
}
|
|
],
|
|
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization."
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-352",
|
|
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
|
|
"lang": "en",
|
|
"type": "CWE"
|
|
},
|
|
{
|
|
"cweId": "CWE-284",
|
|
"description": "CWE-284 Improper Access Control",
|
|
"lang": "en",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
|
|
"shortName": "Joomla",
|
|
"dateUpdated": "2026-07-28T05:35:26.645Z"
|
|
},
|
|
"references": [
|
|
{
|
|
"tags": [
|
|
"product"
|
|
],
|
|
"url": "https://regularlabs.com/"
|
|
}
|
|
],
|
|
"source": {
|
|
"discovery": "UNKNOWN"
|
|
},
|
|
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints",
|
|
"x_generator": {
|
|
"engine": "Vulnogram 0.1.0-dev"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 8,
|
|
"attackVector": "NETWORK",
|
|
"baseSeverity": "HIGH",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
|
|
"integrityImpact": "HIGH",
|
|
"userInteraction": "REQUIRED",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "HIGH"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-07-27T18:39:24.695155Z",
|
|
"id": "CVE-2026-63265",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-07-27T18:39:57.471Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |