The generic audio and video output layouts in Joomla 6.1 escaped only the src attribute and printed every other attribute value, attribute name and thetype raw. A content editor who can set media custom field values (such as a video poster) can inject JavaScript that runs in the browser of any visitor or administrator viewing the item.

This vulnerability affects the following application versions:

  • Joomla 6.1.0
  • Joomla 6.1.1
  • Joomla 6.1.2
  • Joomla 6.1.3

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *