When Joomla rendered an HTML e-mail through a mail layout, MailTemplate::send() substituted template tags without HTML escaping. User-supplied values such as a contact form’s sender name, e-mail and message, a private message subject, and the name and username used in registration, activation, reminder and password-reset mails were inserted raw, so a visitor could inject markup into e-mails read by site owners and administrators.
This vulnerability affects the following application versions:
- Joomla 4.0.0
- Joomla 4.0.1
- Joomla 4.0.2
- Joomla 4.0.3
- Joomla 4.0.4
- Joomla 4.0.5
- Joomla 4.0.6
- Joomla 4.1.0
- Joomla 4.1.1
- Joomla 4.1.2
- Joomla 4.1.3
- Joomla 4.1.4
- Joomla 4.1.5
- Joomla 4.2.0
- Joomla 4.2.1
- Joomla 4.2.2
- Joomla 4.2.3
- Joomla 4.2.4
- Joomla 4.2.5
- Joomla 4.2.6
- Joomla 4.2.7
- Joomla 4.2.8
- Joomla 4.2.9
- Joomla 4.3.0
- Joomla 4.3.1
- Joomla 4.3.2
- Joomla 4.3.3
- Joomla 4.3.4
- Joomla 4.4.0
- Joomla 4.4.1
- Joomla 4.4.2
- Joomla 4.4.3
- Joomla 4.4.4
- Joomla 4.4.5
- Joomla 4.4.6
- Joomla 4.4.7
- Joomla 4.4.8
- Joomla 4.4.9
- Joomla 4.4.10
- Joomla 4.4.11
- Joomla 4.4.12
- Joomla 4.4.13
- Joomla 4.4.14
- Joomla 5.0.0
- Joomla 5.0.1
- Joomla 5.0.2
- Joomla 5.0.3
- Joomla 5.1.0
- Joomla 5.1.1
- Joomla 5.1.2
- Joomla 5.1.3
- Joomla 5.1.4
- Joomla 5.2.0
- Joomla 5.2.1
- Joomla 5.2.2
- Joomla 5.2.3
- Joomla 5.2.4
- Joomla 5.2.5
- Joomla 5.2.6
- Joomla 5.3.0
- Joomla 5.3.1
- Joomla 5.3.2
- Joomla 5.3.3
- Joomla 5.3.4
- Joomla 5.4.0
- Joomla 5.4.1
- Joomla 5.4.2
- Joomla 5.4.3
- Joomla 5.4.4
- Joomla 5.4.5
- Joomla 5.4.6
- Joomla 5.4.7
- Joomla 5.4.8
- Joomla 6.0.0
- Joomla 6.0.1
- Joomla 6.0.2
- Joomla 6.0.3
- Joomla 6.0.4
- Joomla 6.1.0
- Joomla 6.1.1
- Joomla 6.1.2
- Joomla 6.1.3