Actively exploited · Published Feb 16, 2023 · Assigned by Joomla
CVE-2023-23752[20230201] - Core - Improper access check in webservice endpoints
Medium 5.3 Exploited
In plain English
A medium-severity improper access control in Joomla! CMS from Joomla! Project. Attackers are actively exploiting it in the wild (listed by CISA on January 8, 2024). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jan 29, 2024.
Official description
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Joomla! Project | Joomla! CMS | 4.0.0-4.2.7 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N