CVE-2017-11364: Joomla!

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.

Affected products

• Joomla! Joomla!: version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.0.5 only; …

Published 2017-08-02. Last modified 2026-06-17.