Security
DJ-HelpfulArticles 1.3 fixes stored XSS flaw
DJ-Extensions has fixed a High-severity stored cross-site scripting flaw in its Joomla article-rating extension, DJ-HelpfulArticles, with version 1.3.
Research published by mySites.guru says version 1.2 allowed an unauthenticated visitor to submit a crafted value through the rating widget. That value could be stored and executed in an administrator’s browser when the Helpful articles overview was opened. The issue is classified as stored XSS under CWE-79.
No CVE has been assigned to this flaw. Earlier releases also have a separate published issue: DJ-HelpfulArticles versions 1.0.0 through 1.1.0 are affected by CVE-2024-27183, another XSS vulnerability rated Medium.
- Update all installations to
1.3. - Review stored rating data after updating; the release does not remove previously planted values.
- If an administrator opened the overview while running an affected version, check for unfamiliar administrator accounts or extensions.
The current issue can be triggered without a visitor account, but requires an administrator to open the affected overview.
Originally reported by mySites.guru.