PT-2021-16927 · Joomla · Joomla!

Phil Taylor · Published 2021-05-26 · Updated 2025-04-03 · CVE-2021-26034

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 3.0.0 through 3.9.26

Description A missing token check causes a CSRF issue in data download endpoints in com banners and com sysinfo. This allows for potential exploitation.

Recommendations For Joomla! versions 3.0.0 through 3.9.26, consider disabling the data download endpoints in com banners and com sysinfo as a temporary workaround until a patch is available. Restrict access to these components to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-JOOMLA-2021-26034

CVE-2021-26034

Affected Products

Joomla!

References · 5

• https://developer.joomla.org/security-centre/854-20210503-core-csrf-in-data-download-endpoints.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26034 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26034 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2021-26034 · Vendor Advisory
• https://t.me/cvenotify/15230 · Telegram Post