apparently this impacts versions 3.2.0 through 3.4.4 https://developer.joomla.org/security-centre/628-20151001-co... but has been fixed in release 3.4.5