CVE-2019-9922: An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.

PriorityP263high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

10.59%

95.2th percentile

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
harmistechnology	je_messenger	—	—

Detection & IOCsextracted from sources · hover to see the quote

url{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd↗

path/index.php/component/jemessenger/box_details↗

→Exploit uses HTTP GET to the Joomla JE Messenger component endpoint with a directory traversal payload in the 'dw_file' parameter targeting /etc/passwd ↗
→Successful exploitation returns HTTP 200 with /etc/passwd content matching the pattern 'root:[x*]:0:0' ↗
→The vulnerable parameter is 'dw_file' combined with 'task=download' in the JE Messenger component route ↗

·Vulnerability is specific to Harmis JE Messenger version 1.2.2 for Joomla!; other versions are not confirmed affected ↗
·The traversal depth in the PoC payload (../../.././../../../) may need adjustment depending on the Joomla! installation path depth on the target system ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv3.05.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.