Unscored CVE-2020-35611 EUVD-2020-23277GHSA-8w64-jvqw-g3qx

[20201102] - Core - Disclosure of secrets in Global Configuration page

Published Dec 28, 2020 · Updated Feb 24, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.

Affected products

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	2.5.0-3.9.22	—

References

https://developer.joomla.org/security-centre/829-20201102-core-disclosure-of-secrets-in-global-configuration-page.html vendor-advisory