0

I read https://blog.sucuri.net/2019/10/throwback-threat-thursday-jce-vulnerability.html

We use JCE and it is so WYSIWIG, i.e., easy for a user that have access to frontend.

I am from the "light side" of loving JCE ant the author of above blog is like from the "dark side" of hating it.

So, is it really so insecure to be discarded from any website or do we only have to pay attention to new component updates (download and install more often)?

Improve this question

1 Answer 1

Reset to default
5

The article starts with the text:

Throwback Threat Thursday is a series of posts where we recall older vulnerabilities that have since been patched by their developers. In the past, these vulnerabilities caused significant impacts to the security of website owners. Some vulnerable sites may be still be found in wild.

Yes, there was a major security issue with JCE editor 8 years ago. The current version of JCE editor does not have any known security issues. I use it on all my sites.

However, as with all software, you should keep all software up-to-date: Joomla itself + all 3rd party extensions.

Improve this answer
1
  • Weellllll. No software is secure. The more relevant question is "Is it secure enough?" and the answer is "probably yes." I don't use it, but that's mainly because so many sites use it that it becomes one of the first parts of a Joomla system that gets attacked, so I find it quicker to just tell the web server to give any com_jce request a 403 and move on to the next request. The fact it draws more attacks doesn't mean it's more insecure than the rest of the system; it just means there's more Bad Guys(tm) looking for the holes in it.
    – Arlen
    Commented Nov 5, 2019 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.