Medium WID-SEC-2024-0430 5 CVEs

Joomla: Mehrere Schwachstellen

Published Feb 20, 2024 · Updated Feb 25, 2024 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.

Product

Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 5

Medium 6.5

CVE-2024-21726 EPSS 49%

[20240205] - Core - Inadequate content filtering within the filter code

Inadequate content filtering leads to XSS vulnerabilities in various components.

Joomla! Project Joomla! CMS Web / CMS

Feb 20, 2024
Medium 6.3

CVE-2024-21722

[20240201] - Core - Insufficient session expiration in MFA management views

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.

Joomla! Project Joomla! CMS Web / CMS

Feb 20, 2024
Medium 6.1

CVE-2024-21724

[20240203] - Core - XSS in media selection fields

Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.

Joomla! Project Joomla! CMS Web / CMS

Feb 20, 2024
Medium 6.1

CVE-2024-21725 EPSS 27%

[20240204] - Core - XSS in mail address outputs

Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.

Joomla! Project Joomla! CMS Web / CMS

Feb 20, 2024
Medium 4.3

CVE-2024-21723

[20240202] - Core - Open redirect in installation application

Inadequate parsing of URLs could result into an open redirect.

Joomla! Project Joomla! CMS Web / CMS

Feb 20, 2024

Revision history

2024-02-25 #2
Bewertung angepasst
2024-02-20 #1
Initiale Fassung

References

Joomla Security Announcements vom 2024-02-20
https://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html
Joomla Security Announcements vom 2024-02-20
https://developer.joomla.org/security-centre/926-20240202-core-open-redirect-in-installation-application.html
Joomla Security Announcements vom 2024-02-20
https://developer.joomla.org/security-centre/927-20240203-core-xss-in-media-selection-fields.html
Joomla Security Announcements vom 2024-02-20
https://developer.joomla.org/security-centre/928-20240204-core-xss-in-mail-address-outputs.html
Joomla Security Announcements vom 2024-02-20
https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.html