iProperty Real Estate (com_iproperty) <= 4.1.1 - Unauthenticated Reflected XSS

iProperty Real Estate by The Thinkery (the component installs under the display name "Intellectual Property"), version 4.1.1 and earlier, contains a reflected cross-site scripting flaw in the filter_keyword GET parameter of the all-properties-with-map endpoint. A crafted URL executes attacker JavaScript in a visitor browser and can be used to steal session tokens. CVSS 6.1 (Medium). Update to a current iProperty release. The version_low floor of 2.0.3 is deliberate: the "Xmap - Intellectual Property" companion plugin reports element com_iproperty at version 2.0.2, and match_extension_type is not currently read by the matcher, so the floor is what keeps that plugin out of this rule.

Affected versions: ≥ 2.0.3 and ≤ 4.1.1

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions