CVE-2018-7482 - CVE House
Back to Database
Status published High CVE-2018-7482

The K2 component 2.8.0 for Joomla! has Incorrect Access Control...

Vulnerability Description

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7482

Credits & Attribution

No credits recorded in the NVD database.

References

More from joomlaworks

View All →
CVE-2010-0696
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos)...
Medium 5
CVE-2009-2395
SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta...
High 7.5

Affected Vendor

joomlaworks

View all reports →

Affected Software

k2
Vulnerable Versions:
2.8.0

Timeline

Official Publish: February 28th, 2018
Last Modified: November 14th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.