CVE-2023-23752 : An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

Published 2023-02-16 17:15:11

Updated 2024-08-14 15:23:06

Source Joomla! Project

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2023-23752

Joomla » Joomla!
Versions from including (>=) 4.0.0 and before (<) 4.2.8
cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
Matching versions

CVE-2023-23752 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Joomla! Improper Access Control Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.

Notes:

https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html; https://nvd.nist.gov/vuln/detail/CVE-2023-23752

Added on 2024-01-08 Action due date 2024-01-29

Exploit prediction scoring system (EPSS) score for CVE-2023-23752

EPSS FAQ

93.72%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-23752

Joomla API Improper Access Checks

Disclosure Date: 2023-02-01

First seen: 2023-09-11

auxiliary/scanner/http/joomla_api_improper_access_checks

Joomla versions between 4.0.0 and 4.2.7, inclusive, contain an improper API access vulnerability. This vulnerability allows unauthenticated users access to webservice endpoints which contain sensitive information. Specifically for this module we exploit the users and c

More information

CVSS scores for CVE-2023-23752

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-08-01
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-23752

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2023-23752

https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html

[20230201] - Core - Improper access check in webservice endpoints
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-23752