جزئیات آسیب‌پذیری
CVE-2026-78074
miniorgange.com Custom API for Joomla extension for Joomlaminiorgange.com Import Export Users for Joomla extension for Joomlaminiorgange.com JoomAI - AI Assistant for Joomla extension for Joomlaminiorgange.com JoomShield by miniOrange extension for Joomlaminiorgange.com Keycloak user sync / User management extension for Joomlaminiorgange.com LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension for Joomla
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
CVSS 4.0
8.8بالا
شرح رسمی (انگلیسی)
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.8بالا | 4.0 | CVEProject cvelistV5 (CNA) (Joomla) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| miniorgange.com | Custom API for Joomla (free) extension for Joomla | 1.0.0-4.2 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Import Export Users for Joomla (free) extension for Joomla | 1.0.0-4.6 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | JoomAI - AI Assistant for Joomla (free) extension for Joomla | 1.0.0-1.0.5 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | JoomShield by miniOrange (free) extension for Joomla | 1.0.0-1.0.2 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Keycloak user sync / User management (free) extension for Joomla | 1.0.0-1.1.0 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free) extension for Joomla | 1.0.0-6.4.7 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Login with Keycloak OAuth Single Sign-On (SSO) | Login with Keycloak (free) extension for Joomla | 1.0.0-1.2.2 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | OAuth Server for Joomla (free) extension for Joomla | 1.0.0-5.1.5 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free) extension for Joomla | 1.0.0-1.2.2 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | OTP Verification For Joomla (free) extension for Joomla | 1.0.0-6.6 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Okta User sync/Bi-directional user management (free) extension for Joomla | 1.0.0-1.1.0 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Restrict Files / Folders / Media Access for Joomla (free) extension for Joomla | 1.0.0-3.7 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | SAML 2.0 IDP for Joomla (free) extension for Joomla | 1.0.0-7.7 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | SAML SP Single Sign On – Login with ADFS (free) extension for Joomla | 1.0.0-6.4 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | SAML SSO for Joomla (free) extension for Joomla | 1.0.0-11.0.2 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | SAML SSO login with google Apps (free) extension for Joomla | 1.0.0-6.4 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | SCIM User Provisioning for Joomla (free) extension for Joomla | 1.0.0-4.0.4 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Single Sign On for Educational Institutes (free) extension for Joomla | 1.0.0-1.2.2 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Staff/Employee Business Directory Search for Active Directory (free) extension for Joomla | 1.0.0-2.0.4 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Two Factor Authentication 2FA for Joomla (free) extension for Joomla | 1.0.0-5.0.9 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | Web3 – Crypto wallet Login & NFT token gating (free) extension for Joomla | 1.0.0-3.5.1 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | miniOrange Oauth Client (free) extension for Joomla | 1.0.0-3.2.0 | CVEProject cvelistV5 (CNA) |
| miniorgange.com | miniOrange User Provisioning with Azure for Joomla (free) extension for Joomla | 1.0.0-1.1.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱- https://www.miniorange.com/ product
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۶/۰۹
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۷
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- Joomla
پیش‌بینی بهره‌برداری (EPSS)
۰٫۵۴٪
احتمال بهره‌برداری در ۳۰ روز
۴۵٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-284Improper Access Control