CVE-2016-8870

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

CVSS v3.0 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3.0 : HIGH

V3 Legend

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc	Third Party Advisory
https://www.exploit-db.com/exploits/40637/	Exploit Third Party Advisory
https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html	Vendor Advisory
https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf	Patch
https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html
https://medium.com/@showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4r	Technical Description Third Party Advisory
http://www.securityfocus.com/bid/93876	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037108	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037107

Configurations

Configuration 1 (hide)

cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*

Information

Published : 2016-11-04 14:59

Updated : 2017-07-28 18:34

NVD link : CVE-2016-8870

Mitre link : CVE-2016-8870

JSON object : View

CWE

CWE-20

Improper Input Validation

Products Affected

joomla

joomla\!

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc", "name": "http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.exploit-db.com/exploits/40637/", "name": "40637", "tags": ["Exploit", "Third Party Advisory"], "refsource": "EXPLOIT-DB"}, {"url": "https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html", "name": "https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf", "name": "https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html", "name": "https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html", "tags": [], "refsource": "MISC"}, {"url": "https://medium.com/@showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4r", "name": "https://medium.com/@showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4r", "tags": ["Technical Description", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/93876", "name": "93876", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1037108", "name": "1037108", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.securitytracker.com/id/1037107", "name": "1037107", "tags": [], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-8870", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2016-11-04T21:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:joomla:joomla\\!:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.6.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:34Z"}

8.1 /10