CVE-2018-11325
9.8
CRITICAL · CVSS 3.0 · EPSS 3.2% (pctl 88)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.2% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-209 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-05-22 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| joomla | joomla\! |
References
- http://www.securityfocus.com/bid/104278
- http://www.securitytracker.com/id/1040966
- https://developer.joomla.org/security-centre/732-20180504-core-installer-leaks-plain-text-password-to-local-user.html
- http://www.securityfocus.com/bid/104278
- http://www.securitytracker.com/id/1040966
- https://developer.joomla.org/security-centre/732-20180504-core-installer-leaks-plain-text-password-to-local-user.html
→ the Explorer · watch your stack · NVD