{"id":2132,"date":"2020-06-04T13:28:12","date_gmt":"2020-06-04T18:28:12","guid":{"rendered":"https:\/\/cert.pa\/?p=2132"},"modified":"2020-06-04T13:28:12","modified_gmt":"2020-06-04T18:28:12","slug":"csirt-panama-aviso-2020-06-4-joomla-actualizacion-de-seguridad-de-joomla-3-9-19","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=2132","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2020-06-4 Joomla: Actualizaci\u00f3n de seguridad de Joomla 3.9.19."},"content":{"rendered":"\n<p>CSIRT Panam\u00e1\nAviso 2020-06-4 Joomla: Actualizaci\u00f3n de seguridad de Joomla 3.9.19.<\/p>\n\n\n\n<p>Gravedad:Media&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vulnerabilidad: CVE-2020-11022 \/\nCVE-2020-11023 \/ CVE-2020-13763 \/ CVE-2020-13762&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Fecha\nde publicaci\u00f3n: Junio 4, 2020<br>\n\u00daltima revisi\u00f3n: Junio 4, 2020<br>\nPortal: https:\/\/www.joomla.org\/<\/p>\n\n\n\n<p><strong>Sistemas Afectados:<\/strong><br>\nVulnerabilidades en la plataforma de joomla que afecta a sus productos, desde\nlas versiones: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>2.5.0\nhasta la 3.9.18<\/li><li>3.0.0\nhasta la 3.9.18<\/li><\/ul>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Descripci\u00f3n<\/strong><br>\n<br>\n<\/li><\/ol>\n\n\n\n<p>Actualizaci\u00f3n de seguridad que afecta a la\nplataforma de joomla, la nueva versi\u00f3n soluciona 5 vulnerabilidades que afectan\na su n\u00facleo, una vulnerabilidad de criticidad media y cuatro de criticidad\nbaja, del tipo Cross-site scripting (XSS), Cross-site request forgery (CSRF) y\nfallo en las configuraciones por defecto. <\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Impacto<\/strong><\/li><\/ol>\n\n\n\n<p>La vulnerabilidad de criticidad media afecta a los\nm\u00e9todos de manipulaci\u00f3n del DOM de jQuery, pudiendo permitir un ataque XSS. Se\nhan asignado los identificadores CVE-2020-11022 y CVE-2020-11023 para esta\nvulnerabilidad.<\/p>\n\n\n\n<p>Las vulnerabilidades de severidad baja est\u00e1n\ndescritas a continuaci\u00f3n:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Una\nfalta de validaci\u00f3n de par\u00e1metros de entrada en la opci\u00f3n de los encabezados de\nlas etiquetas de los m\u00f3dulos &#8220;Articles \u2013 Newsflash&#8221; y &#8220;Articles\n\u2013 Categories&#8221;, permitir\u00edan realizar ataques XSS. Se ha asignado el\nidentificador CVE-2020-13761 para esta vulnerabilidad<\/li><li>Los\npar\u00e1metros por defecto de la configuraci\u00f3n global de &#8220;textfilter&#8221; no\nbloquean entradas HTML de los usuarios invitados (&#8220;Guest&#8221;). Se ha\nasignado el CVE-2020-13763 para esta vulnerabilidad<\/li><li>Una\nincorrecta validaci\u00f3n de entrada en la etiqueta opci\u00f3n del m\u00f3dulo com_modules\npodr\u00eda permitir ataques XSS. Se ha asignado el identificador CVE-2020-13762\npara esta vulnerabilidad.<\/li><li>Una\nfalta de comprobaci\u00f3n de los tokens en com_postinstall podr\u00eda permitir un\nataque del tipo CSRF. Se ha asignado el identificador CVE-2020-13760 para esta\nvulnerabilidad. <\/li><\/ul>\n\n\n\n<p><strong>III. Referencia a soluciones, herramientas e\ninformaci\u00f3n<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Aplicar la actualizaci\u00f3n a la nueva versi\u00f3n joomla 3.9.19\n(https:\/\/www.joomla.org\/announcements\/release-news\/5812-joomla-3-9-19.html). <\/p>\n\n\n\n<p><strong>Fuentes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Instituto Nacional de Ciberseguridad (INCIBE). 3 de\njunio del 2020. Vulnerabilidades. Recopilado en: https:\/\/www.incibe-cert.es\/alerta-temprana\/avisos-seguridad\/actualizacion-seguridad-joomla-3919<\/li><\/ul>\n\n\n\n<p><strong>Informaci\u00f3n de contacto<\/strong><br>\nCSIRT PANAMA<br>\nComputer Security Incident Response Team Autoridad Nacional para la Innovacion\nGubernamental<br>\nE-Mail: info@cert.pa<br>\nPhone: +507 520-CERT (2378)<br>\nWeb: https:\/\/cert.pa<br>\nTwitter: @CSIRTPanama<br>\nKey ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CSIRT Panam\u00e1 Aviso 2020-06-4 Joomla: Actualizaci\u00f3n de seguridad de Joomla 3.9.19. Gravedad:Media&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vulnerabilidad: CVE-2020-11022 \/ CVE-2020-11023 \/ CVE-2020-13763 \/ CVE-2020-13762&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Fecha de publicaci\u00f3n: Junio 4, 2020 \u00daltima revisi\u00f3n: Junio 4, 2020 Portal: https:\/\/www.joomla.org\/ Sistemas Afectados:&#8230;<\/p>\n","protected":false},"author":4,"featured_media":460,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[76,72,22],"class_list":["post-2132","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-actualizaciones","tag-avisos-de-seguridad","tag-joomla"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2132","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2132"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2132\/revisions"}],"predecessor-version":[{"id":2133,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2132\/revisions\/2133"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/460"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2132"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}