Joomla! security bypass weakness and XSS vulnerability

A weakness and a vulnerability have been reported in Joomla!, which can be exploited by malicious people to bypass certain security restrictions and conduct cross-site scripting attacks, according to Secunia.

1. Certain unspecified input is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

This vulnerability is reported in versions prior to 1.7.3.

2. An error in the random number generation when resetting passwords can be exploited to change a user’s password.

This weakness is reported in versions prior to 1.7.3 and 1.5.25.

Solution: Update to version 1.7.3. or 1.5.25.