CVE

Id
95690  
CVE No.
CVE-2016-8870  
Status
Candidate  
Description
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.  
Phase
Assigned (20161021)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
799158 95690 CVE-2016-8870 EXPLOIT-DB:40637  View
799159 95690 CVE-2016-8870 URL:https://www.exploit-db.com/exploits/40637/  View
799160 95690 CVE-2016-8870 MISC:http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc  View
799161 95690 CVE-2016-8870 MISC:https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html  View
799162 95690 CVE-2016-8870 MISC:https://medium.com/@showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4r  View
799163 95690 CVE-2016-8870 CONFIRM:https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html  View
799164 95690 CVE-2016-8870 CONFIRM:https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf  View
799165 95690 CVE-2016-8870 BID:93876  View
799166 95690 CVE-2016-8870 URL:http://www.securityfocus.com/bid/93876  View
799167 95690 CVE-2016-8870 SECTRACK:1037108  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
4968 JVNDB-2016-005741 Exponent CMS の /framework/modules/ecommerce/controllers/orderController.php における情報公開の脆弱性 Exponent CMS の /framework/modules/ecommerce/controllers/orderController.php は、信用できない入力を selectObjectsBySql に与えるため、情報公開の脆弱性が存在します。 CVE-2016-9183 95690 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005741.html  View