PT-2023-1543 · Joomla · Joomla!
Zewei Zhang
·
Published
2023-02-16
·
Updated
2026-05-22
·
CVE-2023-23752
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Joomla! versions 4.0.0 through 4.2.7
Description
An improper access check exists in Joomla! versions 4.0.0 through 4.2.7, allowing unauthorized access to webservice endpoints. Attackers can exploit this issue to gain access to sensitive information. A proof-of-concept (PoC) exploit involves sending a request to the
/api/index.php/v1/config/application?public=true API Endpoint with the public parameter set to true. The GambleForce threat actor has been observed attempting to exploit this vulnerability, along with others, in attacks against websites in the Asia-Pacific region. While they attempted to exploit this vulnerability in Brazil, they were unsuccessful in extracting data. The vulnerability could potentially lead to code execution. Approximately 127,548 Joomla installations are potentially exposed according to ZoomEye data.Recommendations
Update to a version later than 4.2.7.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Joomla!