Security
Kunena security updates fix stored XSS and data exposure
mySites.guru reports that Kunena 7.1.1 and 6.4.17 are security releases addressing stored cross-site scripting in the Joomla forum extension. Kunena 7.1.1 also fixes unauthorised access to member information and forum controls.
The affected software is Kunena, developed by the Kunena Team. The reported XSS flaws affect versions before 7.1.1 and before 6.4.17, including vulnerable code found in Kunena 5.x and earlier 6.x lines. The fixes cover forum post features including video, SoundCloud, Instagram and attachment output.
mySites.guru assessed the stored XSS issue at CVSS 4.0 5.1. Exploitation requires a forum account able to post, followed by another user viewing the content. The research also rates unauthorised member-data access at CVSS 4.0 6.9; this issue is fixed only in 7.1.1. No CVE identifiers have been published, and the report does not describe active exploitation.
- Administrators on Kunena 7.x should update to
7.1.1. - Administrators on Kunena 6.4 should install
6.4.17and plan a move to 7.1.1. - Older Kunena and Joomla 3 installations have no fix in their existing line and should plan a Joomla and Kunena migration.
Originally reported by mySites.guru.