PT-2020-17363 · Open Source Matters · Joomla!

Published 2020-12-28 · Updated 2025-04-03 · CVE-2020-35611

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 2.5.0 through 3.9.22

Description An issue was discovered where the global configuration page does not remove secrets from the HTML output, disclosing the current values.

Recommendations For Joomla! versions 2.5.0 through 3.9.22, update to a version that removes secrets from the HTML output of the global configuration page to prevent disclosure of sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-JOOMLA-2020-35611

CVE-2020-35611

Affected Products

Joomla!

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-35611 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35611 · Vendor Advisory
• https://developer.joomla.org/security-centre/829-20201102-core-disclosure-of-secrets-in-global-configuration-page.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2020-35611 · Vendor Advisory
• https://t.me/cibsecurity/21365 · Telegram Post