CVE-2015-4071 EXPLOIT
5.3
MEDIUM · CVSS 3.0 · EPSS 9.6% (pctl 95)
Patch early
A public exploit exists.
Description
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.
Scoring
| CVSS | 5.3 (MEDIUM, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| EPSS | 9.55% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-200 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-08-18 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| helpdesk pro project | helpdesk pro |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities | 2015-07-21 |
References
- http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Jul/102
- http://seclists.org/fulldisclosure/2015/Jul/82
- http://www.securityfocus.com/bid/75971
- https://www.exploit-db.com/exploits/37666/
- http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Jul/102
- http://seclists.org/fulldisclosure/2015/Jul/82
- http://www.securityfocus.com/bid/75971
- https://www.exploit-db.com/exploits/37666/
→ the Explorer · watch your stack · NVD