The "Summer of Security" continues.
Joomla! just released today Joomla 6.1.3 and Joomla 5.4.8. These are security & bugfix releases for the Joomla 5.x and 6.x series.
And i released today iCagenda 4.0.13, a new Security & bugfix release for iCagenda versions 4.0.8 to 4.0.12.
This security vulnerability does not concern versions prior to 4.0.8. It's a regression introduced in version 4.0.8.
Artificial intelligence is currently driving a massive surge in cybersecurity attacks, with AI-enabled threat activity skyrocketing by 89% over the past year. This isn't limited to Joomla or its extensions; the entire web is increasingly facing these kinds of attacks.
While AI assists you in your daily life or work, it also aids hackers, and everything moves faster these days.
That is why I promptly release security updates as soon as a flaw is discovered—whether it is publicly known or as yet unknown and unexploited. I handle this with complete transparency; I will never hide a vulnerability behind a generic "bug fix" label.
You should not delay in updating whenever a security version becomes available—whether it is for your operating system, your phone, your favorite app, a Joomla extension, or Joomla itself.
The Stored (persistent) XSS vulnerability was responsibly reported by Akinlabi Omoogun (lulztigre.pw).
I thank Akinlabi for reporting this issue with detailed information and helping me improve the security of iCagenda.
All users running an affected version should update immediately.
What is the vulnerability?
We deliberately choose not to publish functional proofs of concept. The goal of this article is to inform the public so that they can update as soon as possible, rather than to provide a method for attackers.
- Vulnerability alone justifies an immediate update if you have any version from 4.0.8 to 4.0.12 installed on your Joomla site. iCagenda installations on Joomla 3 are not affected by this critical vulnerability.
NOTE: By default, the "Submit an Event" form in frontend is set to registered. This vulnerability is exploitable if the frontend form to submit an event is published and set to public access.
Security Advisory
Issue: Stored (persistent) XSS vulnerability (When the submit an event form is public)
Severity: Critical
Probability: High
CVE Number: pending
Versions affected: Versions 4.0.8 through 4.0.12 are affected.
Solution: Upgrade to version 4.0.13 or later
Reported By: Akinlabi Omoogun of lulztigre.pw
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | none | 4.0.8-4.0.12 | 4.0.8-4.0.12 | 4.0.8-4.0.12 |
| Stored (persistent) XSS vulnerability | no | yes | yes | yes |
If you don't have updated yet, please update right now!
The version 4.0.13 is for Joomla 4 up to latest Joomla 6 version.
If you have any questions please post on the forum or open a new support ticket if you own an active Pro Subscription.