发布日期：2008-08-12
更新日期：2008-08-23

受影响系统：

Joomla! Joomla! 1.5.x

不受影响系统：

Joomla! Joomla! 1.5.6

描述：

---

BUGTRAQ  ID: 30667
CVE(CAN) ID: CVE-2008-3681

Joomla!是一款开放源码的内容管理系统(CMS)。

Joomla! 1.5-1.5.5的components/com_user/models/reset.php没有正确验证重置令牌，远程攻击者可利用此漏洞重置管理员的 "first enabled user (lowest id)"密码。

<*来源：d3mon
  
  链接：http://xforce.iss.net/xforce/xfdb/44430
*>

建议：

---

厂商补丁：

Joomla!
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://developer.joomla.org/security/




Joomla Joomla 1.5.0 Beta
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5 RC3
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5 RC1
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5 Beta 2
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5 RC2
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5.1
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5.2
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5.3
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5.4
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip


Joomla Joomla 1.5.5
Joomla Joomla_1.5.6-Stable-Full_Package.zip
http://joomlacode.org/gf/download/frsrelease/8232/30034/Joomla_1.5.6-S table-Full_Package.zip

浏览次数：1839
严重程度：0（网友投票）