PT-2021-16928 · Joomla · Joomla!

Hoang Nguyen · Published 2021-07-07 · Updated 2025-04-03 · CVE-2021-26035

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 3.0.0 through 3.9.27

Description An issue was discovered in the JForm API, where inadequate escaping in the rules field leads to a XSS vulnerability.

Recommendations For versions 3.0.0 through 3.9.27, update to a version that includes the fix for the inadequate escaping issue in the JForm API rules field.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JOOMLA-2021-26035

CVE-2021-26035

Affected Products

Joomla!

References · 6

• https://osv.dev/vulnerability/BIT-joomla-2021-26035 · Vendor Advisory
• https://developer.joomla.org/security-centre/856-20210701-core-xss-in-jform-rules-field.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26035 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26035 · Vendor Advisory
• https://t.me/cvenotify/17202 · Telegram Post
• https://t.me/cvenotify/17205 · Telegram Post