It was missing a CSRF token check in the LESS compiler of com_templates caused a CSRF vulnerability.
CVE-2020-8420
This vulnerability affects the following application versions:
- Joomla 3.8.4
- Joomla 3.8.4-rc
- Joomla 3.8.4-rc2
- Joomla 3.8.5
- Joomla 3.8.5-rc
- Joomla 3.8.6
- Joomla 3.8.6-rc1
- Joomla 3.8.7
- Joomla 3.8.7-rc
- Joomla 3.8.8
- Joomla 3.8.8-rc
- Joomla 3.8.9
- Joomla 3.8.9-rc
- Joomla 3.8.10
- Joomla 3.8.11
- Joomla 3.8.12
- Joomla 3.8.13
- Joomla 3.9.0
- Joomla 3.9.1
- Joomla 3.9.2
- Joomla 3.9.3
- Joomla 3.9.4
- Joomla 3.9.5
- Joomla 3.9.6
- Joomla 3.9.7
- Joomla 3.9.8
- Joomla 3.9.9
- Joomla 3.9.10
- Joomla 3.9.11
- Joomla 3.9.12
- Joomla 3.9.13
- Joomla 3.9.14