PT-2021-15382 · Joomla · Joomla!

Hanno Böck · Published 2021-03-04 · Updated 2025-04-03 · CVE-2021-23127

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 3.2.0 through 3.9.24

Description An issue was discovered in the usage of an insufficient length for the 2FA secret according to RFC 4226, where 10 bytes were used instead of the recommended 20 bytes.

Recommendations For Joomla! versions 3.2.0 through 3.9.24, update to a version that uses a sufficient length for the 2FA secret, as per RFC 4226 recommendations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BIT-JOOMLA-2021-23127

CVE-2021-23127

Affected Products

Joomla!

References · 5

• https://developer.joomla.org/security-centre/841-20210301-core-insecure-randomness-within-2fa-secret-generation.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23127 · Security Note
• https://osv.dev/vulnerability/BIT-joomla-2021-23127 · Vendor Advisory
• https://t.me/cvenotify/10883 · Telegram Post