PT-2025-2598 · Joomla+2 · Joomla!+1

Lokesh Dachepalli · Published 2025-01-07 · Updated 2025-06-05 · CVE-2024-40748

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue is related to a lack of output escaping in the id attribute of menu lists. This could potentially lead to issues where user input is not properly sanitized, although specific details about exploitation or affected devices are not provided.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JOOMLA-2024-40748

CVE-2024-40748

Affected Products

Joomla!

Joomla! Cms

References · 7

• https://developer.joomla.org/security-centre/955-20250102-core-xss-vector-in-the-id-attribute-of-menu-lists.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40748 · Security Note
• https://osv.dev/vulnerability/BIT-joomla-2024-40748 · Vendor Advisory
• https://twitter.com/CVEnew/status/1876890103123152905 · Twitter Post
• https://t.me/cvenotify/124667 · Telegram Post
• https://t.me/cvedetector/14584 · Telegram Post