PT-2023-1543 · Joomla · Joomla!
Zewei Zhang
·
Publicado
2023-02-16
·
Atualizado
2026-05-22
·
CVE-2023-23752
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Joomla! versions 4.0.0 through 4.2.7
Description
An improper access check exists in Joomla! versions 4.0.0 through 4.2.7, allowing unauthorized access to webservice endpoints. Attackers can exploit this issue to gain access to sensitive information. A proof-of-concept (PoC) exploit involves sending a request to the
/api/index.php/v1/config/application?public=true API Endpoint with the public parameter set to true. The GambleForce threat actor has been observed attempting to exploit this vulnerability, along with others, in attacks against websites in the Asia-Pacific region. While they attempted to exploit this vulnerability in Brazil, they were unsuccessful in extracting data. The vulnerability could potentially lead to code execution. Approximately 127,548 Joomla installations are potentially exposed according to ZoomEye data.Recommendations
Update to a version later than 4.2.7.
Exploit
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Joomla!