{"api_version":"1","generated_at":"2026-07-23T02:17:38+00:00","cve":"CVE-2012-2901","urls":{"html":"https://cve.report/CVE-2012-2901","api":"https://cve.report/api/cve/CVE-2012-2901.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-2901","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-2901"},"summary":{"title":"CVE-2012-2901","description":"Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2012-05-21 18:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75670","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75670","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32","name":"http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"JCE 2.1 released","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/secunia_research/2012-14/","name":"http://secunia.com/secunia_research/2012-14/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/53559","name":"http://www.securityfocus.com/bid/53559","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Joomla! JCE Component 'index.php' Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/49206","name":"http://secunia.com/advisories/49206","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-2901","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2901","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"2901","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"joomla","cpe5":"joomla\\!","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"2901","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ryan_demmer","cpe5":"joomla_content_editor","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"2901","vulnerable":"1","versionEndIncluding":"2.0.21","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ryan_demmer","cpe5":"joomla_content_editor","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T19:50:05.214Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"53559","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/53559"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32"},{"name":"jce-joomla-index-xss(75670)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75670"},{"name":"49206","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/49206"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://secunia.com/secunia_research/2012-14/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-05-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"53559","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/53559"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32"},{"name":"jce-joomla-index-xss(75670)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75670"},{"name":"49206","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/49206"},{"tags":["x_refsource_MISC"],"url":"http://secunia.com/secunia_research/2012-14/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-2901","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"53559","refsource":"BID","url":"http://www.securityfocus.com/bid/53559"},{"name":"http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32","refsource":"CONFIRM","url":"http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32"},{"name":"jce-joomla-index-xss(75670)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75670"},{"name":"49206","refsource":"SECUNIA","url":"http://secunia.com/advisories/49206"},{"name":"http://secunia.com/secunia_research/2012-14/","refsource":"MISC","url":"http://secunia.com/secunia_research/2012-14/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2012-2901","datePublished":"2012-05-21T18:00:00.000Z","dateReserved":"2012-05-21T00:00:00.000Z","dateUpdated":"2024-08-06T19:50:05.214Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-05-21 18:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ryan_demmer:joomla_content_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"2.0.21","matchCriteriaId":"92C9BDA4-CE80-4A40-9E91-5AC89F610390"},{"vulnerable":true,"criteria":"cpe:2.3:a:ryan_demmer:joomla_content_editor:2.0:*:*:*:*:*:*:*","matchCriteriaId":"B8F60EF7-C422-40FF-8A70-1F5DCB096BF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:joomla:joomla\\!:*:*:*:*:*:*:*:*","matchCriteriaId":"2AC7400C-F6AF-4B5E-A34B-0222F94DCC46"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"2901","Ordinal":"1","Title":"CVE-2012-2901","CVE":"CVE-2012-2901","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"2901","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php.","Type":"Description","Title":"CVE-2012-2901"},{"CveYear":"2012","CveId":"2901","Ordinal":"2","NoteData":"2012-05-21","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"2901","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}