PT-2023-27551 · Joomla · Jcdashboards

Published 2023-12-14 · Updated 2024-10-08 · CVE-2023-40630

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JCDashboards component for Joomla (affected versions not specified)

Description The issue concerns an unauthenticated Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) in the JCDashboards component for Joomla. LFI allows an attacker to include files from the server, potentially revealing sensitive information, while SSRF enables an attacker to make requests to internal servers, which could lead to further exploitation. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-40630

Affected Products

Jcdashboards

References · 6

• https://osv.dev/vulnerability/CVE-2023-40630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40630 · Security Note
• https://t.me/cvenotify/97447 · Telegram Post
• https://t.me/cvenotify/63660 · Telegram Post
• https://extensions.joomla.org/extension/jcdashboards · Note
• https://twitter.com/CVEnew/status/1735227037827154196 · Twitter Post