Joomla Major Vulnerability in 1.5.x releases under 1.5.18

[davidb]

Hey all,
Joomla 1.5.17 and older are effected by an XSS Vulnerability. The easiest thing to do is if you are using 1.5.17 already then just download the update package and upload the files over the top (as there are no major changes to joomla's DB).

Bellow is a copy of the reports from Joomla's site:

From http://www.joomla.org/announcements/release-news/5276-joomla-1518-released.html

Security
    * High Priority - Core - XSS Vulnerabilities in back end. More information »

From http://developer.joomla.org/security/news/314-20100501-core-xss-vulnerabilities-in-back-end.html

[20100501] - Core - XSS Vulnerabilities in Back End
Friday, 28 May 2010 00:00
    * Project: Joomla!
    * SubProject: All
    * Severity: High
    * Versions: 1.5.17 and all previous 1.5 releases
    * Exploit type: XSS Injection
    * Reported Date: 2010-May-13
    * Fixed Date: 2010-May-28

Description:
Back-end user can inject javascript in various administrator screens.
Affected Installs
All 1.5.x installs prior to and including 1.5.17 are affected.
Solution
Upgrade to the latest Joomla! version (1.5.18 or later)

Reported by Riyaz Ahemed

Can we please push to get this package updated if it hasn't been done already.
Thanks

[Aric]

Hi,

Thanks for the heads-up. I believe this is being worked on now.

Regards,

Aric

[davetanguay]

Being worked on? Your last reply was over 1 month ago.

Please include Joomla 1.5.18 in Fantastico updates.

[fabiosilva]

PLEASE update joomla to latest version!

Less talk, more work!

Thank's!

[fireman_biff]

Since the last Fantastico release, Joomla has released versions 1.5.18, 1.5.19 and 1.5.20 which are all security releases.

Any word on when Fantastico will be brought up to date with regards to Joomla?

[kili]

Any news when Joomla will be upgraded to the latest version? The delays seem to be getting longer and longer.

Kili

[Mahendra]

Fantastico already has Joomla 1.5.20 as of 9 days ago.

http://www.netenberg.com/forum/index.php?topic=7460.0

[kili]

I'm signed up for alerts from Netenberg. I haven't received an email advising of the upgrades. But thank you for the heads up I'll go and check fantastico

Kili