Open source bug poses threat to sites running multiple CMSes
Peter Reutemann <[email protected]>
| Newsgroups | gmane.org.user-groups.linux.waikato |
|---|---|
| Message-ID | <CAHoQ12JyQBLN0SWBYDhkyNumg=J2ZJYFZeftcUSfFACS++8AvQ@mail.gmail.com> |
'Websites running the Drupal, Joomla, or Typo3 content-management systems are vulnerable to attacks that could possibly execute malicious code until administrators install just-released patches, developers and security researchers warned. The vulnerability resides in the PharStreamWrapper, a PHP component developed and open-sourced by CMS maker Typo3. Indexed as CVE-2019-11831, the flaw stems from a path-traversal bug that allows hackers to swap a site's legitimate phar archive with a malicious one. A phar archive is used to distribute a complete PHP application or library in a single file, in much the way a Java archive file bundles many Java files into a single file.' -- source: https://arstechnica.com/information-technology/2019/05/open-source-bug-poses-threat-to-sites-running-multiple-cmses/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/ _______________________________________________ wlug mailing list | [email protected] Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug