---
title: "[20190301] - Core - XSS in com_config JSON handler"
description: "We help designers, developers, hobbyists and business owners get the most out of the Joomla CMS.  Join us at our free monthly meetups, and let us help you with your Joomla projects."
url: "https://www.joomlalondon.co.uk/official-joomla-announcements/20190301-core-xss-in-com-config-json-handler"
date: "2026-09-09T16:19:30+00:00"
language: "en-GB"
---

#  \[20190301\] - Core - XSS in com\_config JSON handler

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Low
- **Severity:** Low
- **Versions:** 3.2.0 through 3.9.3
- **Exploit type:** XSS
- **Reported Date:** 2019-March-04
- **Fixed Date:** 2019-March-12
- **CVE Number:** [CVE-2019-9712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9712)

### Description

The JSON handler in com\_config lacks input validation, leading to XSS vulnerability.

### Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

### Solution

Upgrade to version 3.9.4

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

**Reported By:** Mario Korth, [Hackmanit](https://www.joomlalondon.co.uk/https:/www.hackmanit.de/)Read more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/JvJtucwH0Xs/772-20190301-core-xss-in-com-config-json-handler.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/JvJtucwH0Xs/772-20190301-core-xss-in-com-config-json-handler.html "[20190301] - Core - XSS in com_config JSON handler")

## Schema

```json
{ "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Start", "item": "https://www.joomlalondon.co.uk" }, { "@type": "ListItem", "position": 2, "name": "Official Joomla! Announcements", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements" }, { "@type": "ListItem", "position": 3, "name": "[20190301] - Core - XSS in com_config JSON handler", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements/20190301-core-xss-in-com-config-json-handler" } ] }
```