Cotton Cloud Extension For Joomla
Monthly
Improper access control in the Cotton Cloud Joomla extension (versions below 2.0.2) by tabaoca.org exposes a broken ACL implementation that allows unauthenticated remote attackers to perform arbitrary file operations - reading, deleting, overwriting, and reassigning permissions - on every file managed within the extension. The network-accessible, zero-authentication attack vector (CVSS 4.0 AV:N/AC:L/PR:N/UI:N) makes exploitation trivially low-effort against any Joomla site running an unpatched Cotton Cloud installation. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is broad enough that no specialized tooling is required.
Improper access control in the Cotton Cloud Joomla extension (versions below 2.0.2) by tabaoca.org exposes a broken ACL implementation that allows unauthenticated remote attackers to perform arbitrary file operations - reading, deleting, overwriting, and reassigning permissions - on every file managed within the extension. The network-accessible, zero-authentication attack vector (CVSS 4.0 AV:N/AC:L/PR:N/UI:N) makes exploitation trivially low-effort against any Joomla site running an unpatched Cotton Cloud installation. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is broad enough that no specialized tooling is required.