Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 9 Mar 2017 17:36:39 +0000
From: Seth Art <>
To: "" <>
Subject: CVE Request: Joomla! FLEXIcontent - Incorrect Authorization
 (Authorization Bypass)

FLEXIcontent ( is an advanced content management system developed to greatly enhance the native content management of Joomla!

Affected Products/Versions:
Note: Previous versions may be affected

Title: Joomla! FLEXIcontent - Incorrect Authorization (Authorization Bypass)
CWE-863: Incorrect Authorization (
Detailed write-up:
Researcher: Seth Art

CWE-863 Description: "The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions."

The FLEXIcontent plugin uses a query string parameter, task, which specifies the action to perform on a FLEXIcontent article.  If an unauthenticated actor provides any value other than edit or a blank value to the task parameter, the actor is able to view the restricted FLEXIcontent article, regardless of the assigned permissions.  Articles are sequentially numbered, which would allow an actor exploiting this vulnerability to gain read-only access to all FLEXIcontent articles by iterating through article identifiers.

http://host/index.php?option=com_flexicontent&view=item&id=#&task=abcd (if Search Engine Friendly URLs are disabled)

Upgrade to flexicontent-cck-3.1.1 or greater

Disclosure Timeline:
2016-09-28: Notified FLEXIcontent author of vulnerability.
2016-09-28: FLEXIcontent author acknowledges vulnerability and confirms it will be fixed.
2016-10-31: FLEXIcontent v3.1.1 is released and silently fixes vulnerability.
2016-11-30: Researcher tests v3.1.1 and determines vulnerability has been fixed.
2016-01-31: Researcher asks the author to mention the security issue in release notes (no response).
2017-03-06: Public disclosure

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.