CVE-2019-25762: JoomProject 1.1.3.2 Unauthenticated User Data Disclosure

Technical summary

The vulnerability exists in the projects endpoint of JoomProject 1.1.3.2. By sending HTTP requests to index.php with the parameters option=com_jpprojects&view=projects&tmpl=component&format=json, an unauthenticated attacker can enumerate and retrieve user data. The component fails to enforce access controls on this endpoint, allowing public disclosure of personally identifiable information (PII). The issue maps to CWE-359 (Privacy Violation), indicating improper access to sensitive user attributes.

Business impact

Exposure of user email addresses and names creates multiple downstream risks: phishing and social engineering attacks become more feasible when attackers possess verified targets; compliance obligations under GDPR, CCPA, and similar regulations are triggered if user data is accessed without consent; reputational damage and potential legal liability accrue if the breach is discovered; and user trust erodes. Organizations running affected Joomla installations with JoomProject may face notification requirements and regulatory fines if this vulnerability is exploited in the wild.

Affected systems

Joomla! installations with JoomProject component version 1.1.3.2 are affected. Earlier or later versions may require validation against the vendor's advisory. Systems exposing Joomla instances to the internet without additional access controls (such as web application firewalls) face direct attack surface. Verify your deployed version and check for any security-focused configuration options that may mitigate exposure.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no special network position—a straightforward HTTP GET or POST request from anywhere on the internet suffices. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this assessment. No exploit code is required; manual testing or simple scripting can trigger the data disclosure. This characteristic places the vulnerability in the highest practical risk tier for exposure-prone systems.

Remediation

Upgrade JoomProject to a patched version released by the vendor. If an immediate upgrade is not feasible, implement one or more compensating controls: restrict access to the /index.php endpoint using web server rules or a WAF, disable the JoomProject component if not in use, or apply URL-level access controls that require authentication before permitting requests to the affected endpoint. Verify all remediations against the vendor's official security advisory.

Patch guidance

Check the official Joomla Extensions Directory and JoomProject vendor site for a security release addressing this issue. Verify the exact patched version number against the vendor's advisory; do not assume a minor version bump indicates a fix. Apply the patch through Joomla's standard update mechanism after testing in a non-production environment. If the vendor has not yet released a patch, prioritize the compensating controls outlined above and plan an upgrade timeline.

Detection guidance

Monitor web server and application logs for requests containing the parameter combination option=com_jpprojects&view=projects&tmpl=component&format=json. Use intrusion detection rules or WAF signatures to alert on these requests. Query application or database audit logs to identify if user data tables were accessed outside normal application flows. Conduct a user notification effort if evidence of successful exploitation is discovered. Correlate timestamps of suspicious requests with any upstream breach indicators.

Why prioritize this

This vulnerability scores HIGH (7.5) due to the combination of unauthenticated access, low attack complexity, and direct exposure of sensitive user information. Although no confidentiality, integrity, or availability impact is scored at the system level, the privacy disclosure of PII warrants immediate attention. Prioritize patching or mitigation for any Joomla instance hosting a public-facing projects component, especially those serving users in regulated industries or geographies.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: Network-accessible attack vector (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). The score appropriately penalizes the ease of exploitation and the sensitive nature of the disclosed data, placing the vulnerability in the HIGH severity category and above the threshold for urgent remediation.

Frequently asked questions