Privileged Stored XSS in Articles Anywhere Joomla Extension

Executive Summary

This is a privileged stored Cross-Site Scripting (XSS) vulnerability in the Articles Anywhere Joomla extension from regularlabs.com. It affects versions before 20.0.0. The issue occurs because the extension accepts link options like onclick and onmouseover without validating the article author's trust level. These options become executable HTML event attributes later, bypassing Joomla's normal content filtering for authors.

Useful 0 Not Useful 0

Impact Analysis

An attacker with author-level access could inject malicious scripts into articles. When other users view these articles, the scripts execute in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on behalf of the user. This could lead to unauthorized data access or account compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches, unauthorized access, or lack of proper input validation and output encoding.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Articles Anywhere extension for Joomla to version 20.0.0 or later to address the privileged stored XSS vulnerability.

Useful 0 Not Useful 0