PT-2023-8698 · Joomla · Joomla!

Carsten Schmitz · Publicado 2023-11-29 · Atualizado 2025-06-03 · CVE-2024-21722

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Joomla (affected versions not specified)

Description The issue is related to the improper termination of existing user sessions when a user's MFA methods have been modified, allowing a remote attacker to access confidential data. Additionally, multiple vulnerabilities have been discovered in the Joomla content management system that could be leveraged to execute arbitrary code on vulnerable websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

BDU:2024-01592

BIT-JOOMLA-2024-21722

CVE-2024-21722

Produtos afetados

Joomla!

Referências · 16

• https://cybersecurity-help.cz/vdb/SB2024022067 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21722 · Nota
• https://t.me/cvenotify/100052 · Publicação no Telegram
• https://t.me/netlas/149 · Publicação no Telegram
• https://t.me/cvenotify/124357 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-21722 · Aviso do Fabricante
• https://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1759981010186367387 · Publicação no Twitter
• http://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html · Nota
• https://twitter.com/Netlas_io/status/1760612901495439595 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-21722 · Nota de Segurança
• https://t.me/true_secator/5448 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-joomla-2024-21722 · Aviso do Fabricante
• https://t.me/zerodayalert/177 · Publicação no Telegram
• https://twitter.com/OdinThreatIntel/status/1760557567904997499 · Publicação no Twitter