PT-2021-16923 · Joomla · Joomla!

Hoang Nguyen · Published 2021-04-14 · Updated 2025-04-03 · CVE-2021-26030

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 3.0.0 through 3.9.25

Description An issue was discovered that allows XSS attacks due to inadequate escaping. This is possible using the logo parameter of the default templates on the error page.

Recommendations For Joomla! versions 3.0.0 through 3.9.25, update to a version that contains a fix for this issue to prevent XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JOOMLA-2021-26030

CVE-2021-26030

Affected Products

Joomla!

References · 4

• https://osv.dev/vulnerability/BIT-joomla-2021-26030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26030 · Security Note
• https://developer.joomla.org/security-centre/850-20210401-core-escape-xss-in-logo-parameter-error-pages.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26030 · Vendor Advisory