CVE-2016-9838 Joomla! Core Privilege Escalation Vulnerability [20161201]

Joomla! is a free and open-source content management system written in PHP. It uses object oriented programming techniques and is built on a model-view-controller web application framework. It includes features such as page caching, RSS feeds, printable versions of pages, news flashes, blogs, polls, search, and support for language internationalization.

Incorrect use of unfiltered data stored to the session on a form validation failure allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments.

Affected Versions:
Joomla! 1.6.0 through 3.6.4

Successful exploitation allows a remote attacker to gain access to elevated privileges on a vulnerable system.

Customers are advised to update to Joomla! 3.6.5 or later versions to fix this vulnerability.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Joomla! 3.6.5 or later