JoomlaWorks K2 2.8.0 for Joomla!
Approved changes feed: RSS · Atom
cpe:2.3:a:joomlaworks:k2:2.8.0:*:*:*:*:joomla\!:*:*
part: a version: 2.8.0 update: *
| Vendor | Joomlaworks (242c3dd5-9a3b-5104-a7a5-68f428f42a6e) |
|---|---|
| Product | K2 (79560f33-0e01-5f29-befb-a0f79bd37634) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | joomla! |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/getk2/k2 |
purl2cpe | 2026-06-01 10:16:06.663018 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-7482 |
vulnerable | 2026-06-08 05:12:03.736331 |
Details available
The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads
Published: 2018-02-28T07:00:00.000Z
Updated: 2024-11-14T20:51:45.731Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.